3. Malware Analysis Tools

Malware Analysis Toolkits and Utilities

• Awesome Malware Analysis

• Malwoverview

• Detect It Easy

• Malware Analysis

• Malware and Reverse Engineering

• Malware Analysis Platform

• Malware Traffic Analysis

• CRITs

• FAME

• Malwarehouse

• Polichombr

A three day course on Android malware reverse engineering (YouTube)

• Day 1

• Day 2

• Day 3

Malware Data Science - VM

• Malware Data Science Ubuntu Virtual Machine

• Malware Data Science Ubuntu VM (Google Drive)

Hex Editors

• HxD

• 010 Editor

• Hex Workshop

• HexFiend

• Hiew

Pegasus

• Pegasus Spyware Analysis Repository

Detection and Classification

• AnalyzePE

• Assemblyline

• BinaryAlert

• ClamAV

• Detect-It-Easy

• ExifTool

• File Scanning Framework

• hashdeep

• Loki

• Malfunction

• MASTIFF

• MultiScanner

• nsrllookup

• PEV

• Rootkit Hunter

• ssdeep

• TrID

• YARA

• Yara rules generator

• Yara docs

Dynamic Binary Instrumentation

• Pin

• DynamoRio

• frida

• dyninst

Emulator

• Qemu

• Unicorn

Document Analysis

Document Based Malware Analysis Tools.

• Ole Tools

• Didier’s PDF Tools

• Origami

Dynamic Analysis

• ProcessHacker

• Process Explorer

• Process Monitor

• Autoruns

• Noriben

• API Monitor

• Wireshark

• Volatility

• LiME

• Cuckoo

• Objective-See Utilities

• Dtrace recipes

• dmesg

• Triton

Deobfuscation Malware Analysis Tools

• Balbuzard

• Kavanoz

• Iheartxor & iheartxor

• FLOSS

• NoMoreXOR

• PackerAttacker

• Unpacker

• unxor

• VirtualDeobfuscator

• XORBruteForcer

• XORSearch & XORStrings

• XORtool

Debugging

IN this List we could see the tools for Disassemblers, debuggers, and other static and dynamic analysis tools. Cross-Platform Debugging Tools

• GDB

• VDB

• LLDB

• Qira

Binary Format and Binary Analysis

• CFF Explorer

• Cerbero Profiler

• PeStudio

• MachoView

Binary Analysis Resources

• Mobius Resources

• bap

• angr

Bytecode Analysis

• dnSpy

• Bytecode Viewer

• JPEXS Flash Decompiler

Malware Analysis Tools for Reconstruction

• Zeltser’s List

• ImpREC

• AVCaesar

• Cryptam

• Cuckoo Sandbox

• cuckoo-modified

• cuckoo-modified-api

• detux

• DRAKVUF

• firmware.re

• HaboMalHunter

• Hybrid Analysis

• Joe Sandbox

• Jotti

• Limon

• Malheur

• Malsub

• Malware config

• Metadefender.com

• Noriben

• PDF Examiner

• ProcDot

• Recomposer

• Sand droid

• SEE

• VirusTotal

• Visualize_Logs

Document Analysis

• Ole Tools

• Origami

Scripting

• IDA Python Src

• IDC Functions Doc

• Using IDAPython to Make your Life Easier

• The Beginner’s Guide to IDA Python

• IDA Plugin Contest

• Onehawt IDA Plugin List

• PEfile Python Libray

Android

• Android Developer Studio

• AndroGuard

• APKtool

• dex2jar

• Bytecode Viewer

• IDA Pro

Domain Malware Analysis Tools

• Zeltser’s List

• Boomerang

• Desenmascara

• Dig

• Dnstwist

• IPinfo

• Machinae

• Mailchecker

• MaltegoVT

• Multi rbl

• NormShield Services

• SpamCop

• SpamHaus

• Sucuri SiteCheck

• Talos Intelligence

• TekDefense Automater

• URLQuery

• Whois

• ZScalar Zulu

Documents and Shellcode

Analyze malicious JS and shellcode from PDFs and Office documents. See also the browser malware section.

• AnalyzePDF

• Box-js

• diStorm

• JS Beautifier

• Malpdfobj

• OfficeMalScanner

• Olevba

• Origami PDF

• PDF Tools

• PDF X-Ray Lite

• Peepdf

Practice Malware Analysis Tools

• OSX Crackmes

• ESET Challenges

• Flare-on Challenges

• Github CTF Archives

• Reverse Engineering Challenges

• XORpd Advanced Assembly Exercises

• Virusshare.com

• Contagio

• Malware-Traffic-Analysis

• vxvault

Cyber Threat Intelligence

Other Resources

• APT Notes

• File Formats posters

• Honeynet Project

• Kernel Mode

• Malicious Software

• Malware Analysis Tutorials

• Practical Malware Analysis Starter Kit

• RPISEC Malware Analysis

• WindowsIR: Malware

• Windows Registry specification

• Malware