Repository Index

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

• binary-analysis
• taint-analysis

A tool for studying JavaScript malware.

• malware
• malwareanalysis
• nodejs
• es6

WinDBG Anti-RootKit Extension

• kernel-mode
• c-plus-plus
• malware
• malware-analysis

Yet another static code analyzer for malicious Android applications

Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js

• malware-samples
• wscript
• deobfuscation
• angler

C++ application that uses memory and code hooks to detect packers

Incident Response - Fast suspicious file finder

• dfir
• investigation
• incident-response
• threat-hunting

Django application that performs SAST and Malware Analysis for Android APKs

• android-security
• sast
• malware-analysis
• code-security

Automatically exported from code.google.com/p/jsunpack-n

x86 emulation and shellcode detection

The current repository contains all the scripts needed to build kernel-mode mac-a-mal malicious activity hooking on macOS.

• macos

Docker image gathering packers and tools for making datasets of packed executables and training machine learning models for packing detection

• docker-image
• executable-packing
• malware-packers
• research-platform