analyzer - Analyze, extract and visualize features, artifacts

项目说明

<p align="center"> <img src="

This project automates the daily tasks of Threat Intelligence Analyzer role internally without external resources' interaction. It analyzes, and structures sensitive files (Malware) or data by extracting features, artifacts and IoC using different modules. The output of those modules can be easily integrated in your research or SOC platforms.

Install

Interface

<img src=" style="max-width:768px"/>

Output

APT-Malware JSON\HTML reports (+190 sample)

Features

Runs locally (Offline)

Analyze buffer, file or full folder

Intime analysis (Session is saved)

2 modes (Interactive and silent)

Generates HTML or JSON as output

Dump output file with details to mongodb

Save raw json result to mongodb

Basic file information MD5, charset, mime, ssdeep

Different string/patterns analysis methods

Web service and API

Ports, IPS hints and countries description

World IPS world image and flags

DNS servers description (Top servers)

Artifacts force directed image

Cross references force directed image and table

Similarity image divided to classes

YARA module, and YARA rules from yara-rules-github)

YARA module includes conditions & tags by index

Whitelist implemented (Windows7, 8 and 10 files)

Check WAF and bypass proxy

Spelling and punctuation check

Top phishing words included

Snort support

PDF, RTF, Phishing, MS office and HTML modules

NL English words detection

OCR words detection

Websites similarity detection (Top 10000)

BOM (Byte Order Mark) detection

MITRE att&ck tools and patterns detection (could be FP)

URL shorteners extraction

ASCII from UNICODE extraction

Free\Fake email extraction

URL, EMAIL, and TEL Tags patterns extraction

Credit Cards, Credential, and Secrets patterns patterns extraction

Encryption patterns (base64, md5, sha1..) extraction

DGA (Domain Generation Algorithm) patterns extraction

Modules

Linux wrapper - ELF information, API functions descriptions, System commands descriptions, Sections descriptions, Lib descriptions, Encrypted section detection, Symbols extraction, MITRE artifacts mapped to detection, Cross references detection, Behavior detection

Windows wrapper - PE information, Encrypted section detection, Sections descriptions, DLL descriptions, Symbols extraction, Signature extraction and , API descriptions, PE ASLR, DEP, SEH and CFG detection, MITRE artifacts mapped to detection, API Behavior detection, DLL injection, Process Hollowing, Process Doppelganging etc.., Cross references detection, Icon extraction, Extract String file info, FileDescription, FileDescription etc..

Android wrapper - APK information, DEX information, Manifest descriptions, Intent descriptions, Resources extraction, Symbols extraction, Classes extraction, Big functions identification, Cross references detection, API Behavior detection

IPhone built-in - IPA information

BlackBerry COD built-in - COD information, Functions extraction, Strings extraction

PCAP wrapper - Frame filter, HTTP filter, DNS filter, ARP filter, WAF detection, DGA detection, Snort parsing

PDF built-in - Objects enumeration, Keys, ja, js, OpenAction, extraction, Streams parsing, String analysis

Office built-in and wrapper - Meta info extraction, Hyper and target links extraction, Bin printable parser, Extract Text, Extract DDE, Macros extraction

OLE wrapper - Number of objects, Object extraction, Macros extraction

EMAIL built-in and wrapper - Header information, Attachment extraction and parsing, Extract body, Phishing patterns check

Archi - Extract mimes and guess by extensions, Finding patterns in all unpacked files, Encrypted archi

HTML wrapper - Extract scripts, iframes, links and forms, Decode/analyze links, Script entropy

Some patterns - AWS Clint ID, Amazon MWS Auth Token, Amazon S3, ALIYUN OSS, AZURE Storage, Facebook Access Token, Github Token, Goole API Key, Google CAPTCHA, Google OAuth, Google Secret, Google OAuth Access Token, Mailgun API Key, MailChimp API, Picatic API, Slack Token, Square Access Token, Square OAuth Secret, Stripe API, Twilio API, Twilio SID

One click auto-configure

Or, if you already ha

Prerequisites

apt-get install -y python3 python3-pip curl libfuzzy-dev yara libmagic-de libssl-de tesseract-ocr libtesseract-de swig p7zip-full radare2 dmg2img mongodb redis

pip3 install pyelftools macholib python-magic nltk Pillow jinja2 ssdeep pefile scapy r2pipe pytesseract M2Crypto requests tld tldextract bs4 psutil pymongo flask pyOpenSSL oletools extract_msg

Prerequisites packages are required for some modules (If you are having issues using those packages, I might be able to share with you my own alternatives that I de in the past in C#\C)

Roadmap

Ja (Requested by users)

Web detection

Adding username and password wrappers to databases

CSS clean up

Resources

Linux documentation, MacOS documentation, Windows documentation, Android documentation, software77, MITRE ATT&CK™, sc0ty, hexacorn, PEID, steren, bacde, cisco umbrella , yara rules community , TONS OF RESEARCHES

Other Licenses

By using this framework, you are accepting the license terms of all these packages: yara, Yara-Rules, tesseract-ocr, swig, radare, , oletools, mongodb, supervisor, msg-extractor, snort, pyelftools, macholib, pefile, scapy, python-magic, flask, werkzeug, gunicorn, flask-mongoengine, flask-admin, flask-login, flask-bcrypt, pyopenssl, flask-markdown, tld, psutil, gevent, dateutil, requests, pymongo, BeautifulSoup, tldextract, m2crypto, radare2, ssdeep, jinja2, Pillow, nltk, p7zip, redislabs, redis-py

Disclaimer\Notes

Do not deploy without proper configuration

Setup some security group rules and remo credentials

This project is NOT an anti malware project and does not quarantine or delete malicious files

This project was de for analyzing classified data and training some AI locally without internet/external interaction

Please let me know if i missed a resource or dependency

Other Projects

![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]()

项目信息

开发语言：Python

Star 数：324

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Analyze, extract and visualize features, artifacts and IoCs of files and memory dumps (Windows, Linux, Android, iPhone, Blackberry, macOS binaries, emails and more)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。