malware-tools - A list of useful tools for Malware Analysis (will

项目说明

Malware Analysis and Incident Response Tools

<img src="/files/cover.png" alt="malware" width="55%" height="30%">

The idea of this repository is to serve as a base of all the tools that we might be using or I recommend to be used for performing different malware analysis and incident response tasks. The list will be updated with new tools regularly.

ONLINE SCANNERS

HYBRID ANALYSIS

Any > Run

- Latest malware trends

Malcore

Malware.id

PORTABLE EXECUTABLE (PE)

CFF Explorer

PE-Bear — by Hasherzade

Detect-It-Easy — by Hors

Dependency Walker

PE Studio

PPEE — or "puppy", which is a Professional PE file Explorer

Resource Hacker

Cerbero

PE Explorer v2 — by Zodiacon

CAPA — by FireEye FLARE Team

Malwo

XPE

PACKERS, DECRYPTERS, COMPRESSORS, EXTRACTORS, ETC

Exeinfo PE — (old ) or here (latest)

PEiD — (password = tuts4you) + signatures

ASPack — (trail)

Detect it Easy (DiE) or here

TitanMist

Reflective PE Packer: Amber

pyinstxtractor — a Python script to extract the contents of a PyInstaller generated executable file.

pyinstxtractor-ng — a tool to extract the contents of a Pyinstaller generated executable file. Both Linux ELFs and Windows PE executables are supported.

etc

DYNAMIC ANALYSIS

Microsoft SysInternals Suite

Process Hacker

ProcDOT or here

- Save as PNG
- Save as SVG

RegShot

Noriben

X64dbg

- Themes:
-
-

Immunity Debugger

Rundll32 (LOLBin)

Injector (Reflective DLL Injection)

API Monitor

PE Capture

Tiny\_tracer

 

- blog

Pe-sieve

Hollows-hunter

Re

Mal\_unpack

etc

NETWORKING

Mandiant ApateDNS

WinDump

CaptureBAT

Fiddler — get the classic

INCIDENT RESPONSE

Skadi — open source collection of tools that enables the collection, processing and ad analysis of forensic artifacts and images.

CyLR — Li Collection tool by Alan Orlikoski and Jason Yegge

KAPE

Yara

YExtend

IOC Editor

IOC Finder

Yara rules

YaraRET

Yara Endpoint

ClamAV

Osquery

GRR

DumpIt (readings: 1, 2)

Memdump — similar to SysInternals

Beagle

Thor-Lite

REVERSE ENGINEERING AND DECOMPILERS

Ghidra

IDA Pro

- Plugins:
-

dnSpyEx — .NET Decompiler and Debugger

Malcat

Binary Ninja

ExtremeDumper — for .NET Executables

Cutter

Rizin

P32Dasm —

Online DeObfuscator/Obfuscator

Basic decompiler

Online Decompiler

Import Hash Generator

MonoDevelop

Decompiler Explorer

etc

MEMORY FORENSICS: Acquisition and Analysis

Rekall

Workbench

Repository — profiles, plugins, community plugins, etc

Rekall

FireEye Redline

Belkasoft RAM Capturer — (free requires registration)

MAGNET RAM Capture — (requires registration)

Memoryze — by FireEye (requires registration)

Surge — Collect by (Commercial)

OSForensics — by PassMark Software (commercial)

WinPmem — (open source), part of Rekall Memory forensic framework

FTK Imager — by AccessData (free requires registration)

Comae Memory Toolkit (DumpIt) — (free requires registration)

MemProcFS

- MemProcFS-Analyzer
- MemProcFS-Hunter

Trufflepig Forensics

etc

EMAIL FORENSICS: Analysis, etc

EmlRender

MALWARE SAMPLES and CODE REPOSITORIES

Any > Run

Malware Bazaar

Anti-X Code and Research

EMULATORS, SANDBOXES, AND ANTI-X

Qiling

Blobrunner

Frida

Windows 10 Sandbox

Shadow Defender

CAPEv2 — Malware Configuration And Payload Extraction

DRAK

Cuckoo — No longer maintained, use CAPEv2 instead

AssemblyLine4

Linux Malware Analysis Sandbox

etc

MISC UTILITIES

bstrings

BinText

StringSifter

Graphivz

Viper

Ssdeep

Studio Code

Exe\_to\_dll

Awesome Docker

sshx — A secure web-based, collaborati

etc

DOCUMENTATION, DATASTRUCTURES, APIs, AND LISTS

Project

Windows APIs used by Malware

NtDoc

RECOMMENDED COURSES

Life of Binaries

Intro to x86 — (Assembly x86)

Intro to x64 — (Assembly 64)

Intro to x64 — (Assembly 64)

Intro to Reverse Engineering — (RE) Malware

Intro to Reverse Engineering — (RE) Software

Dynamic Malware Analysis

Ransomware 101

RECOMMENDED AND CHANNELS

Learn x64 Assembly

My YouTube Channel — (will be updated)

John Hammond - Malware Analysis

OALabs

Hasherzade

MalwareAnalysisForHedgehogs

All Things IDA

Hex-Rays

CODE AND WHITE PAPERS

— Lots of great research papers all in one place

Kernel Data Structures — I depend on this reference

LoadLibrary-GetProcAddress-Replacements

zerosum0x0 Defcon25 Workshop

Windows Internals

PROCESSINFOCLASS Native APIs

USEFUL TIPS AND TRICKS

Yara Generation Tip

Win32-shellcode

Dealing with exceptions in x64dbg

Something missing? You recommend somthing? Please let me know…

项目信息

开发语言：HTML

Star 数：167

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A list of useful tools for Malware Analysis (will be updated regularly)展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。