RichHeaderResearch / RichPE
Metadata hash incorporating the Rich Header for robustness against packing and other malware tricks
☆62Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for RichPE
- A tool that automates regex generation for the x86 and x86-64 instruction sets☆62Updated 7 months ago
- ☆66Updated last year
- Parsers for custom malware formats ("Funky malware formats")☆92Updated 2 years ago
- Transfer EIP control to shellcode during malware analysis investigation☆73Updated 10 years ago
- Go Lang Portable Executable Parser☆37Updated 3 years ago
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆89Updated 3 years ago
- Scripts, Yara rules and other files developed during malware investigations☆24Updated 2 years ago
- Capa analysis importer for Ghidra.☆61Updated 3 years ago
- List of tools to assist in analyzing samples of ISFB/Gozi/Ursnif☆15Updated 5 years ago
- Malware Configuration Extraction Modules☆47Updated last year
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆30Updated 4 years ago
- MWDB exercises☆19Updated 5 months ago
- ☆100Updated last year
- API Logger for Windows Executables☆77Updated 4 years ago
- capemon: CAPE's monitor☆102Updated last week
- Robust Automated Malware Unpacker☆84Updated last year
- runsc loads 32/64 bit shellcode (depending on how runsc is compiled) in a way that makes it easy to load in a debugger. This code is base…☆36Updated last year
- Parse .NET executable files.☆74Updated last week
- Various Yara signatures (possibly to be included in a release later).☆85Updated 5 years ago
- Shellcode emulator written with Unicorn Framework With Process Dump Emulation Environment☆117Updated 4 years ago
- BinSequencer is a script designed to find a common pattern of bytes within a set of samples and generate a YARA rule from the identified…☆74Updated 2 years ago
- Resources for the workshop titled "Repacking the unpacker: Applying Time Travel Debugging to malware analysis", given at HackLu 2019☆39Updated 5 years ago
- ☆27Updated 2 years ago
- GarbageMan is a set of tools for analyzing .NET binaries through heap analysis.☆114Updated last year
- Small visualizator for PE files☆67Updated last year
- Userland API monitor for threat hunting☆55Updated 4 years ago
- Use YARA rules on Time Travel Debugging traces☆86Updated last year
- A golang CLI tool to download malware from a variety of sources.☆141Updated 9 months ago
- mod to myaut2exe decompiler☆13Updated 7 years ago
- Native Python3 bindings for @horsicq's Detect-It-Easy☆48Updated 3 weeks ago