{"id":415,"url":"https://github.com/rshipp/awesome-malware-analysis","last_synced_at":"2025-09-29T00:32:41.966Z","repository":{"id":31747623,"uuid":"35313712","full_name":"rshipp/awesome-malware-analysis","owner":"rshipp","description":"Defund the Police.","archived":false,"fork":false,"pushed_at":"2024-06-07T05:09:47.000Z","size":659,"stargazers_count":12999,"open_issues_count":25,"forks_count":2642,"subscribers_count":704,"default_branch":"main","last_synced_at":"2025-09-23T03:02:06.646Z","etag":null,"topics":["analysis-framework","automated-analysis","awesome","awesome-list","chinese","chinese-translation","domain-analysis","drop-ice","dynamic-analysis","list","malware-analysis","malware-collection","malware-research","malware-samples","network-traffic","static-analysis","threat-intelligence","threat-sharing","threatintel"],"latest_commit_sha":null,"homepage":"https://gazafunds.com/","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rshipp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":null,"patreon":null,"open_collective":null,"ko_fi":"rshipp","tidelift":null,"community_bridge":null,"custom":null}},"created_at":"2015-05-09T03:39:28.000Z","updated_at":"2025-09-23T01:51:58.000Z","dependencies_parsed_at":"2022-07-13T09:20:34.009Z","dependency_job_id":"b8e06b47-c94b-44c0-bba8-53da471cd934","html_url":"https://github.com/rshipp/awesome-malware-analysis","commit_stats":{"total_commits":510,"total_committers":115,"mean_commits":4.434782608695652,"dds":0.5137254901960784,"last_synced_commit":"8421117304c1a87fd0f436b900d4e5462262c438"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/rshipp/awesome-malware-analysis","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fawesome-malware-analysis","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fawesome-malware-analysis/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fawesome-malware-analysis/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fawesome-malware-analysis/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rshipp","download_url":"https://codeload.github.com/rshipp/awesome-malware-analysis/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rshipp%2Fawesome-malware-analysis/sbom","scorecard":{"id":787309,"data":{"date":"2025-08-11","repo":{"name":"github.com/rshipp/awesome-malware-analysis","commit":"179887b9bfb04bb736348b2dc9d331bc860c6ef7"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.2,"checks":[{"name":"Code-Review","score":9,"reason":"Found 11/12 approved changesets -- score normalized to 9","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":-1,"reason":"No tokens found","details":null,"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Pinned-Dependencies","score":-1,"reason":"no dependencies found","details":null,"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":-1,"reason":"no workflows found","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-23T06:24:41.375Z","repository_id":31747623,"created_at":"2025-08-23T06:24:41.375Z","updated_at":"2025-08-23T06:24:41.375Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":277450939,"owners_count":25819971,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-28T02:00:08.834Z","response_time":79,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["analysis-framework","automated-analysis","awesome","awesome-list","chinese","chinese-translation","domain-analysis","drop-ice","dynamic-analysis","list","malware-analysis","malware-collection","malware-research","malware-samples","network-traffic","static-analysis","threat-intelligence","threat-sharing","threatintel"],"created_at":"2024-01-05T20:12:54.263Z","updated_at":"2025-09-29T00:32:41.716Z","avatar_url":"https://github.com/rshipp.png","language":null,"readme":"# Awesome Malware Analysis [![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome)\n\nA curated list of awesome malware analysis tools and resources. Inspired by\n[awesome-python](https://github.com/vinta/awesome-python) and\n[awesome-php](https://github.com/ziadoz/awesome-php).\n\n[![Drop ICE](drop.png)](https://twitter.com/githubbers/status/1182017616740663296)\n\n- [Malware Collection](#malware-collection)\n    - [Anonymizers](#anonymizers)\n    - [Honeypots](#honeypots)\n    - [Malware Corpora](#malware-corpora)\n- [Open Source Threat Intelligence](#open-source-threat-intelligence)\n    - [Tools](#tools)\n    - [Other Resources](#other-resources)\n- [Detection and Classification](#detection-and-classification)\n- [Online Scanners and Sandboxes](#online-scanners-and-sandboxes)\n- [Domain Analysis](#domain-analysis)\n- [Browser Malware](#browser-malware)\n- [Documents and Shellcode](#documents-and-shellcode)\n- [File Carving](#file-carving)\n- [Deobfuscation](#deobfuscation)\n- [Debugging and Reverse Engineering](#debugging-and-reverse-engineering)\n- [Network](#network)\n- [Memory Forensics](#memory-forensics)\n- [Windows Artifacts](#windows-artifacts)\n- [Storage and Workflow](#storage-and-workflow)\n- [Miscellaneous](#miscellaneous)\n- [Resources](#resources)\n    - [Books](#books)\n    - [Other](#other)\n- [Related Awesome Lists](#related-awesome-lists)\n- [Contributing](#contributing)\n- [Thanks](#thanks)\n\nView Chinese translation: [恶意软件分析大合集.md](恶意软件分析大合集.md).\n\n---\n\n## Malware Collection\n\n### Anonymizers\n\n*Web traffic anonymizers for analysts.*\n\n* [Anonymouse.org](http://anonymouse.org/) - A free, web based anonymizer.\n* [OpenVPN](https://openvpn.net/) - VPN software and hosting solutions.\n* [Privoxy](http://www.privoxy.org/) - An open source proxy server with some\n  privacy features.\n* [Tor](https://www.torproject.org/) - The Onion Router, for browsing the web\n  without leaving traces of the client IP.\n\n### Honeypots\n\n*Trap and collect your own samples.*\n\n* [Conpot](https://github.com/mushorg/conpot) - ICS/SCADA honeypot.\n* [Cowrie](https://github.com/micheloosterhof/cowrie) - SSH honeypot, based\n  on Kippo.\n* [DemoHunter](https://github.com/RevengeComing/DemonHunter) - Low interaction Distributed Honeypots.\n* [Dionaea](https://github.com/DinoTools/dionaea) - Honeypot designed to trap malware.\n* [Glastopf](https://github.com/mushorg/glastopf) - Web application honeypot.\n* [Honeyd](http://www.honeyd.org/) - Create a virtual honeynet.\n* [HoneyDrive](https://bruteforce.gr/honeydrive/) - Honeypot bundle Linux distro.\n* [Honeytrap](https://github.com/honeytrap/honeytrap) - Opensource system for running, monitoring and managing honeypots.\n* [MHN](https://github.com/pwnlandia/mhn) - MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface.\n* [Mnemosyne](https://github.com/johnnykv/mnemosyne) - A normalizer for\n  honeypot data; supports Dionaea.\n* [Thug](https://github.com/buffer/thug) - Low interaction honeyclient, for\n  investigating malicious websites.\n\n\n### Malware Corpora\n\n*Malware samples collected for analysis.*\n\n* [Clean MX](http://support.clean-mx.com/clean-mx/viruses.php) - Realtime\n  database of malware and malicious domains.\n* [Contagio](http://contagiodump.blogspot.com/) - A collection of recent\n  malware samples and analyses.\n* [Exploit Database](https://www.exploit-db.com/) - Exploit and shellcode\n  samples.\n* [Infosec - CERT-PA](https://infosec.cert-pa.it/analyze/submission.html) - Malware samples collection and analysis.\n* [InQuest Labs](https://labs.inquest.net) - Evergrowing searchable corpus of malicious Microsoft documents.\n* [Javascript Mallware Collection](https://github.com/HynekPetrak/javascript-malware-collection) - Collection of almost 40.000 javascript malware samples\n* [Malpedia](https://malpedia.caad.fkie.fraunhofer.de/) - A resource providing\n  rapid identification and actionable context for malware investigations.\n* [Malshare](https://malshare.com) - Large repository of malware actively\n  scrapped from malicious sites.\n* [Ragpicker](https://github.com/robbyFux/Ragpicker) - Plugin based malware\n  crawler with pre-analysis and reporting functionalities\n* [theZoo](https://github.com/ytisf/theZoo) - Live malware samples for\n  analysts.\n* [Tracker h3x](http://tracker.h3x.eu/) - Agregator for malware corpus tracker\n  and malicious download sites.\n* [vduddu malware repo](https://github.com/vduddu/Malware) - Collection of\n  various malware files and source code.\n* [VirusBay](https://beta.virusbay.io/) - Community-Based malware repository and social network.\n* [ViruSign](http://www.virussign.com/) - Malware database that detected by\n  many anti malware programs except ClamAV.\n* [VirusShare](https://virusshare.com/) - Malware repository, registration\n  required.\n* [VX Vault](http://vxvault.net) - Active collection of malware samples.\n* [Zeltser's Sources](https://zeltser.com/malware-sample-sources/) - A list\n  of malware sample sources put together by Lenny Zeltser.\n* [Zeus Source Code](https://github.com/Visgean/Zeus) - Source for the Zeus\n  trojan leaked in 2011.\n* [VX Underground](http://vx-underground.org/) - Massive and growing collection of free malware samples.\n\n## Open Source Threat Intelligence\n\n### Tools\n\n*Harvest and analyze IOCs.*\n\n* [AbuseHelper](https://github.com/abusesa/abusehelper) - An open-source\n  framework for receiving and redistributing abuse feeds and threat intel.\n* [AlienVault Open Threat Exchange](https://otx.alienvault.com/) - Share and\n  collaborate in developing Threat Intelligence.\n* [Combine](https://github.com/mlsecproject/combine) - Tool to gather Threat\n  Intelligence indicators from publicly available sources.\n* [Fileintel](https://github.com/keithjjones/fileintel) - Pull intelligence per file hash.\n* [Hostintel](https://github.com/keithjjones/hostintel) - Pull intelligence per host.\n* [IntelMQ](https://www.enisa.europa.eu/topics/csirt-cert-services/community-projects/incident-handling-automation) -\n  A tool for CERTs for processing incident data using a message queue.\n* [IOC Editor](https://www.fireeye.com/services/freeware/ioc-editor.html) -\n  A free editor for XML IOC files.\n* [iocextract](https://github.com/InQuest/python-iocextract) - Advanced Indicator\n  of Compromise (IOC) extractor, Python library and command-line tool.\n* [ioc_writer](https://github.com/mandiant/ioc_writer) - Python library for\n  working with OpenIOC objects, from Mandiant.\n* [MalPipe](https://github.com/silascutler/MalPipe) - Malware/IOC ingestion and\n  processing engine, that enriches collected data.\n* [Massive Octo Spice](https://github.com/csirtgadgets/massive-octo-spice) -\n  Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs\n  from various lists. Curated by the\n  [CSIRT Gadgets Foundation](http://csirtgadgets.org/collective-intelligence-framework).\n* [MISP](https://github.com/MISP/MISP) - Malware Information Sharing\n  Platform curated by [The MISP Project](http://www.misp-project.org/).\n* [Pulsedive](https://pulsedive.com) - Free, community-driven threat intelligence platform collecting IOCs from open-source feeds.\n* [PyIOCe](https://github.com/pidydx/PyIOCe) - A Python OpenIOC editor.\n* [RiskIQ](https://community.riskiq.com/) - Research, connect, tag and\n  share IPs and domains. (Was PassiveTotal.)\n* [threataggregator](https://github.com/jpsenior/threataggregator) -\n  Aggregates security threats from a number of sources, including some of\n  those listed below in [other resources](#other-resources).\n* [ThreatConnect](https://threatconnect.com/free/) - TC Open allows you to see and\n  share open source threat data, with support and validation from our free community.\n* [ThreatCrowd](https://www.threatcrowd.org/) - A search engine for threats,\n  with graphical visualization.\n* [ThreatIngestor](https://github.com/InQuest/ThreatIngestor/) - Build\n  automated threat intel pipelines sourcing from Twitter, RSS, GitHub, and\n  more.\n* [ThreatTracker](https://github.com/michael-yip/ThreatTracker) - A Python\n  script to monitor and generate alerts based on IOCs indexed by a set of\n  Google Custom Search Engines.\n* [TIQ-test](https://github.com/mlsecproject/tiq-test) - Data visualization\n  and statistical analysis of Threat Intelligence feeds.\n\n### Other Resources\n\n*Threat intelligence and IOC resources.*\n\n* [Autoshun](https://www.autoshun.org/) ([list](https://www.autoshun.org/files/shunlist.csv)) -\n  Snort plugin and blocklist.\n* [Bambenek Consulting Feeds](http://osint.bambenekconsulting.com/feeds/) -\n  OSINT feeds based on malicious DGA algorithms.\n* [Fidelis Barncat](https://www.fidelissecurity.com/resources/fidelis-barncat) -\n  Extensive malware config database (must request access).\n* [CI Army](http://cinsscore.com/) ([list](http://cinsscore.com/list/ci-badguys.txt)) -\n  Network security blocklists.\n* [Critical Stack- Free Intel Market](https://intel.criticalstack.com) - Free\n  intel aggregator with deduplication featuring 90+ feeds and over 1.2M indicators.\n* [Cybercrime tracker](http://cybercrime-tracker.net/) - Multiple botnet active tracker.\n* [FireEye IOCs](https://github.com/fireeye/iocs) - Indicators of Compromise\n  shared publicly by FireEye.\n* [FireHOL IP Lists](https://iplists.firehol.org/) - Analytics for 350+ IP lists\n  with a focus on attacks, malware and abuse. Evolution, Changes History,\n  Country Maps, Age of IPs listed, Retention Policy, Overlaps.\n* [HoneyDB](https://riskdiscovery.com/honeydb) - Community driven honeypot sensor data collection and aggregation.\n* [hpfeeds](https://github.com/rep/hpfeeds) - Honeypot feed protocol.\n* [Infosec - CERT-PA lists](https://infosec.cert-pa.it/analyze/statistics.html) ([IPs](https://infosec.cert-pa.it/analyze/listip.txt) - [Domains](https://infosec.cert-pa.it/analyze/listdomains.txt) - [URLs](https://infosec.cert-pa.it/analyze/listurls.txt)) - Blocklist service.\n* [InQuest REPdb](https://labs.inquest.net/repdb) - Continuous aggregation of IOCs from a variety of open reputation sources.\n* [InQuest IOCdb](https://labs.inquest.net/iocdb) - Continuous aggregation of IOCs from a variety of blogs, Github repos, and Twitter.\n* [Internet Storm Center (DShield)](https://isc.sans.edu/) - Diary and\n  searchable incident database, with a web [API](https://dshield.org/api/).\n  ([unofficial Python library](https://github.com/rshipp/python-dshield)).\n* [malc0de](http://malc0de.com/database/) - Searchable incident database.\n* [Malware Domain List](http://www.malwaredomainlist.com/) - Search and share\n  malicious URLs.\n* [MetaDefender Threat Intelligence Feed](https://www.opswat.com/developers/threat-intelligence-feed) -\n  List of the most looked up file hashes from MetaDefender Cloud.\n* [OpenIOC](https://www.fireeye.com/services/freeware.html) - Framework for sharing threat intelligence.\n* [Proofpoint Threat Intelligence](https://www.proofpoint.com/us/products/et-intelligence) -\n  Rulesets and more. (Formerly Emerging Threats.)\n* [Ransomware overview](https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml) -\n  A list of ransomware overview with details, detection and prevention.\n* [STIX - Structured Threat Information eXpression](http://stixproject.github.io) -\n  Standardized language to represent and share cyber threat information.\n  Related efforts from [MITRE](https://www.mitre.org/):\n  - [CAPEC - Common Attack Pattern Enumeration and Classification](http://capec.mitre.org/)\n  - [CybOX - Cyber Observables eXpression](http://cyboxproject.github.io)\n  - [MAEC - Malware Attribute Enumeration and Characterization](http://maec.mitre.org/)\n  - [TAXII - Trusted Automated eXchange of Indicator Information](http://taxiiproject.github.io)\n* [SystemLookup](https://www.systemlookup.com/) - SystemLookup hosts a collection of lists that provide information on\n  the components of legitimate and potentially unwanted programs.\n* [ThreatMiner](https://www.threatminer.org/) - Data mining portal for threat\n  intelligence, with search.\n* [threatRECON](https://threatrecon.co/) - Search for indicators, up to 1000\n  free per month.\n* [ThreatShare](https://threatshare.io/) - C2 panel tracker\n* [Yara rules](https://github.com/Yara-Rules/rules) - Yara rules repository.\n* [YETI](https://github.com/yeti-platform/yeti) - Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.\n* [ZeuS Tracker](https://zeustracker.abuse.ch/blocklist.php) - ZeuS\n  blocklists.\n\n## Detection and Classification\n\n*Antivirus and other malware identification tools*\n\n* [AnalyzePE](https://github.com/hiddenillusion/AnalyzePE) - Wrapper for a\n  variety of tools for reporting on Windows PE files.\n* [Assemblyline](https://cybercentrecanada.github.io/assemblyline4_docs/) - A scalable file triage and malware analysis system integrating the cyber security community's best tools..\n* [BinaryAlert](https://github.com/airbnb/binaryalert) - An open source, serverless\n  AWS pipeline that scans and alerts on uploaded files based on a set of\n  YARA rules.\n* [capa](https://github.com/fireeye/capa) - Detects capabilities in executable files.\n* [chkrootkit](http://www.chkrootkit.org/) - Local Linux rootkit detection.\n* [ClamAV](http://www.clamav.net/) - Open source antivirus engine.\n* [Detect It Easy(DiE)](https://github.com/horsicq/Detect-It-Easy) - A program for\n  determining types of files.\n* [Exeinfo PE](http://exeinfo.pe.hu/) - Packer, compressor detector, unpack\n  info, internal exe tools.\n* [ExifTool](https://sno.phy.queensu.ca/~phil/exiftool/) - Read, write and\n  edit file metadata.\n* [File Scanning Framework](https://github.com/EmersonElectricCo/fsf) -\n  Modular, recursive file scanning solution.\n* [fn2yara](https://github.com/cmu-sei/pharos) - FN2Yara is a tool to generate\n  Yara signatures for matching functions (code) in an executable program.\n* [Generic File Parser](https://github.com/uppusaikiran/generic-parser) - A Single Library Parser to extract meta information,static analysis and detect macros within the files.\n* [hashdeep](https://github.com/jessek/hashdeep) - Compute digest hashes with\n  a variety of algorithms.\n* [HashCheck](https://github.com/gurnec/HashCheck) - Windows shell extension\n  to compute hashes with a variety of algorithms.\n* [Loki](https://github.com/Neo23x0/Loki) - Host based scanner for IOCs.\n* [Malfunction](https://github.com/Dynetics/Malfunction) - Catalog and\n  compare malware at a function level.\n* [Manalyze](https://github.com/JusticeRage/Manalyze) - Static analyzer for PE\nexecutables.\n* [MASTIFF](https://github.com/KoreLogicSecurity/mastiff) - Static analysis\n  framework.\n* [MultiScanner](https://github.com/mitre/multiscanner) - Modular file\n  scanning/analysis framework\n* [Nauz File Detector(NFD)](https://github.com/horsicq/Nauz-File-Detector) - Linker/Compiler/Tool detector  for Windows, Linux and MacOS.\n* [nsrllookup](https://github.com/rjhansen/nsrllookup) - A tool for looking\n  up hashes in NIST's National Software Reference Library database.\n* [packerid](https://github.com/sooshie/packerid) - A cross-platform\n  Python alternative to PEiD.\n* [PE-bear](https://hshrzd.wordpress.com/pe-bear/) - Reversing tool for PE\n  files.\n* [PEframe](https://github.com/guelfoweb/peframe) - PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.\n* [PEV](http://pev.sourceforge.net/) - A multiplatform toolkit to work with PE\n  files, providing feature-rich tools for proper analysis of suspicious binaries.\n* [PortEx](https://github.com/katjahahn/PortEx) - Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness.\n* [Quark-Engine](https://github.com/quark-engine/quark-engine) - An Obfuscation-Neglect Android Malware Scoring System\n* [Rootkit Hunter](http://rkhunter.sourceforge.net/) - Detect Linux rootkits.\n* [ssdeep](https://ssdeep-project.github.io/ssdeep/) - Compute fuzzy hashes.\n* [totalhash.py](https://gist.github.com/gleblanc1783/3c8e6b379fa9d646d401b96ab5c7877f) -\n  Python script for easy searching of the [TotalHash.cymru.com](https://totalhash.cymru.com/)\n  database.\n* [TrID](http://mark0.net/soft-trid-e.html) - File identifier.\n* [YARA](https://plusvic.github.io/yara/) - Pattern matching tool for\n  analysts.\n* [Yara rules generator](https://github.com/Neo23x0/yarGen) - Generate\n  yara rules based on a set of malware samples. Also contains a good\n  strings DB to avoid false positives.\n* [Yara Finder](https://github.com/uppusaikiran/yara-finder) - A simple tool to yara match the file against various yara rules to find the indicators of suspicion.\n\n\n## Online Scanners and Sandboxes\n\n*Web-based multi-AV scanners, and malware sandboxes for automated analysis.*\n\n* [anlyz.io](https://sandbox.anlyz.io/) - Online sandbox.\n* [any.run](https://app.any.run/) - Online interactive sandbox.\n* [AndroTotal](https://andrototal.org/) - Free online analysis of APKs\n  against multiple mobile antivirus apps.\n* [BoomBox](https://github.com/nbeede/BoomBox) - Automatic deployment of Cuckoo\n  Sandbox malware lab using Packer and Vagrant.\n* [Cryptam](http://www.cryptam.com/) - Analyze suspicious office documents.\n* [Cuckoo Sandbox](https://cuckoosandbox.org/) - Open source, self hosted\n  sandbox and automated analysis system.\n* [cuckoo-modified](https://github.com/brad-accuvant/cuckoo-modified) - Modified\n  version of Cuckoo Sandbox released under the GPL. Not merged upstream due to\n  legal concerns by the author.\n* [cuckoo-modified-api](https://github.com/keithjjones/cuckoo-modified-api) - A\n  Python API used to control a cuckoo-modified sandbox.\n* [DeepViz](https://www.deepviz.com/) - Multi-format file analyzer with\n  machine-learning classification.\n* [detux](https://github.com/detuxsandbox/detux/) - A sandbox developed to do\n  traffic analysis of Linux malwares and capturing IOCs.\n* [DRAKVUF](https://github.com/tklengyel/drakvuf) - Dynamic malware analysis\n  system.\n* [filescan.io](https://www.filescan.io/) - Static malware analysis, VBA/Powershell/VBS/JS Emulation  \n* [firmware.re](http://firmware.re/) - Unpacks, scans and analyzes almost any\n  firmware package.\n* [HaboMalHunter](https://github.com/Tencent/HaboMalHunter) - An Automated Malware\n  Analysis Tool for Linux ELF Files.\n* [Hybrid Analysis](https://www.hybrid-analysis.com/) - Online malware\n  analysis tool, powered by VxSandbox.\n* [Intezer](https://analyze.intezer.com) - Detect, analyze, and categorize malware by\n  identifying code reuse and code similarities.\n* [IRMA](http://irma.quarkslab.com/) - An asynchronous and customizable\n  analysis platform for suspicious files.\n* [Joe Sandbox](https://www.joesecurity.org) - Deep malware analysis with Joe Sandbox.\n* [Jotti](https://virusscan.jotti.org/en) - Free online multi-AV scanner.\n* [Limon](https://github.com/monnappa22/Limon) - Sandbox for Analyzing Linux Malware.\n* [Malheur](https://github.com/rieck/malheur) - Automatic sandboxed analysis\n  of malware behavior.\n* [malice.io](https://github.com/maliceio/malice) - Massively scalable malware analysis framework.\n* [malsub](https://github.com/diogo-fernan/malsub) - A Python RESTful API framework for\n  online malware and URL analysis services.\n* [Malware config](https://malwareconfig.com/) - Extract, decode and display online\n  the configuration settings from common malwares.\n* [MalwareAnalyser.io](https://malwareanalyser.io/) - Online malware anomaly-based static analyser with heuristic detection engine powered by data mining and machine learning.\n* [Malwr](https://malwr.com/) - Free analysis with an online Cuckoo Sandbox\n  instance.\n* [MetaDefender Cloud](https://metadefender.opswat.com/ ) - Scan a file, hash, IP, URL or\n  domain address for malware for free.\n* [NetworkTotal](https://www.networktotal.com/index.html) - A service that analyzes\n  pcap files and facilitates the quick detection of viruses, worms, trojans, and all\n  kinds of malware using Suricata configured with EmergingThreats Pro.\n* [Noriben](https://github.com/Rurik/Noriben) - Uses Sysinternals Procmon to\n  collect information about malware in a sandboxed environment.\n* [PacketTotal](https://packettotal.com/) - PacketTotal is an online engine for analyzing .pcap files, and visualizing the network traffic within.\n* [PDF Examiner](http://www.pdfexaminer.com/) - Analyse suspicious PDF files.\n* [ProcDot](http://www.procdot.com) - A graphical malware analysis tool kit.\n* [Recomposer](https://github.com/secretsquirrel/recomposer) - A helper\n  script for safely uploading binaries to sandbox sites.\n* [sandboxapi](https://github.com/InQuest/python-sandboxapi) - Python library for\n  building integrations with several open source and commercial malware sandboxes.\n* [SEE](https://github.com/F-Secure/see) - Sandboxed Execution Environment (SEE)\n  is a framework for building test automation in secured Environments.\n* [SEKOIA Dropper Analysis](https://malware.sekoia.fr/) - Online dropper analysis (Js, VBScript, Microsoft Office, PDF).\n* [VirusTotal](https://www.virustotal.com/) - Free online analysis of malware\n  samples and URLs\n* [Visualize_Logs](https://github.com/keithjjones/visualize_logs) - Open source\n  visualization library and command line tools for logs.  (Cuckoo, Procmon, more\n  to come...)\n* [Zeltser's List](https://zeltser.com/automated-malware-analysis/) - Free\n  automated sandboxes and services, compiled by Lenny Zeltser.\n\n## Domain Analysis\n\n*Inspect domains and IP addresses.*\n\n* [AbuseIPDB](https://www.abuseipdb.com/) - AbuseIPDB is a project dedicated\n  to helping combat the spread of hackers, spammers, and abusive activity on the internet.\n* [badips.com](https://www.badips.com/) - Community based IP blacklist service.\n* [boomerang](https://github.com/EmersonElectricCo/boomerang) - A tool designed\n  for consistent and safe capture of off network web resources.\n* [Cymon](https://cymon.io/) - Threat intelligence tracker, with IP/domain/hash\n  search.\n* [Desenmascara.me](http://desenmascara.me) - One click tool to retrieve as\n  much metadata as possible for a website and to assess its good standing.\n* [Dig](https://networking.ringofsaturn.com/) - Free online dig and other\n  network tools.\n* [dnstwist](https://github.com/elceef/dnstwist) - Domain name permutation\n  engine for detecting typo squatting, phishing and corporate espionage.\n* [IPinfo](https://github.com/hiddenillusion/IPinfo) - Gather information\n  about an IP or domain by searching online resources.\n* [Machinae](https://github.com/hurricanelabs/machinae) - OSINT tool for\n  gathering information about URLs, IPs, or hashes. Similar to Automator.\n* [mailchecker](https://github.com/FGRibreau/mailchecker) - Cross-language\n  temporary email detection library.\n* [MaltegoVT](https://github.com/michael-yip/MaltegoVT) - Maltego transform\n  for the VirusTotal API. Allows domain/IP research, and searching for file\n  hashes and scan reports.\n* [Multi rbl](http://multirbl.valli.org/) - Multiple DNS blacklist and forward\n  confirmed reverse DNS lookup over more than 300 RBLs.\n* [NormShield Services](https://services.normshield.com/) - Free API Services\n  for detecting possible phishing domains, blacklisted ip addresses and breached\n  accounts.\n* [PhishStats](https://phishstats.info/) - Phishing Statistics with search for\n  IP, domain and website title\n* [Spyse](https://spyse.com/) - subdomains, whois, realted domains, DNS, hosts AS, SSL/TLS info,\n* [SecurityTrails](https://securitytrails.com/) - Historical and current WHOIS,\n  historical and current DNS records, similar domains, certificate information\n  and other domain and IP related API and tools.\n* [SpamCop](https://www.spamcop.net/bl.shtml) - IP based spam block list.\n* [SpamHaus](https://www.spamhaus.org/lookup/) - Block list based on\n  domains and IPs.\n* [Sucuri SiteCheck](https://sitecheck.sucuri.net/) - Free Website Malware\n  and Security Scanner.\n* [Talos Intelligence](https://talosintelligence.com/) - Search for IP, domain\n  or network owner. (Previously SenderBase.)\n* [TekDefense Automater](http://www.tekdefense.com/automater/) - OSINT tool\n  for gathering information about URLs, IPs, or hashes.\n* [URLhaus](https://urlhaus.abuse.ch/) - A project from abuse.ch with the goal\n  of sharing malicious URLs that are being used for malware distribution.\n* [URLQuery](http://urlquery.net/) - Free URL Scanner.\n* [urlscan.io](https://urlscan.io/) - Free URL Scanner \u0026 domain information.\n* [Whois](https://whois.domaintools.com/) - DomainTools free online whois\n  search.\n* [Zeltser's List](https://zeltser.com/lookup-malicious-websites/) - Free\n  online tools for researching malicious websites, compiled by Lenny Zeltser.\n* [ZScalar Zulu](https://zulu.zscaler.com/#) - Zulu URL Risk Analyzer.\n\n## Browser Malware\n\n*Analyze malicious URLs. See also the [domain analysis](#domain-analysis) and\n[documents and shellcode](#documents-and-shellcode) sections.*\n\n* [Bytecode Viewer](https://github.com/Konloch/bytecode-viewer) - Combines\n  multiple Java bytecode viewers and decompilers into one tool, including\n  APK/DEX support.\n* [Firebug](https://getfirebug.com/) - Firefox extension for web development.\n* [Java Decompiler](http://jd.benow.ca/) - Decompile and inspect Java apps.\n* [Java IDX Parser](https://github.com/Rurik/Java_IDX_Parser/) - Parses Java\n  IDX cache files.\n* [JSDetox](http://www.relentless-coding.com/projects/jsdetox/) - JavaScript\n  malware analysis tool.\n* [jsunpack-n](https://github.com/urule99/jsunpack-n) - A javascript\n  unpacker that emulates browser functionality.\n* [Krakatau](https://github.com/Storyyeller/Krakatau) - Java decompiler,\n  assembler, and disassembler.\n* [Malzilla](http://malzilla.sourceforge.net/) - Analyze malicious web pages.\n* [RABCDAsm](https://github.com/CyberShadow/RABCDAsm) - A \"Robust\n  ActionScript Bytecode Disassembler.\"\n* [SWF Investigator](https://labs.adobe.com/technologies/swfinvestigator/) -\n  Static and dynamic analysis of SWF applications.\n* [swftools](http://www.swftools.org/) - Tools for working with Adobe Flash\n  files.\n* [xxxswf](http://hooked-on-mnemonics.blogspot.com/2011/12/xxxswfpy.html) - A\n  Python script for analyzing Flash files.\n\n## Documents and Shellcode\n\n*Analyze malicious JS and shellcode from PDFs and Office documents. See also\nthe [browser malware](#browser-malware) section.*\n\n* [AnalyzePDF](https://github.com/hiddenillusion/AnalyzePDF) - A tool for\n  analyzing PDFs and attempting to determine whether they are malicious.\n* [box-js](https://github.com/CapacitorSet/box-js) - A tool for studying JavaScript\n  malware, featuring JScript/WScript support and ActiveX emulation.\n* [diStorm](http://www.ragestorm.net/distorm/) - Disassembler for analyzing\n  malicious shellcode.\n* [InQuest Deep File Inspection](https://labs.inquest.net/dfi) - Upload common malware lures for Deep File Inspection and heuristical analysis.\n* [JS Beautifier](http://jsbeautifier.org/) - JavaScript unpacking and deobfuscation.\n* [libemu](http://libemu.carnivore.it/) - Library and tools for x86 shellcode\n  emulation.\n* [malpdfobj](https://github.com/9b/malpdfobj) - Deconstruct malicious PDFs\n  into a JSON representation.\n* [OfficeMalScanner](http://www.reconstructer.org/code.html) - Scan for\n  malicious traces in MS Office documents.\n* [olevba](http://www.decalage.info/python/olevba) - A script for parsing OLE\n  and OpenXML documents and extracting useful information.\n* [Origami PDF](https://code.google.com/archive/p/origami-pdf) - A tool for\n  analyzing malicious PDFs, and more.\n* [PDF Tools](https://blog.didierstevens.com/programs/pdf-tools/) - pdfid,\n  pdf-parser, and more from Didier Stevens.\n* [PDF X-Ray Lite](https://github.com/9b/pdfxray_lite) - A PDF analysis tool,\n  the backend-free version of PDF X-RAY.\n* [peepdf](http://eternal-todo.com/tools/peepdf-pdf-analysis-tool) - Python\n  tool for exploring possibly malicious PDFs.\n* [QuickSand](https://www.quicksand.io/) - QuickSand is a compact C framework\n  to analyze suspected malware documents to identify exploits in streams of different\n  encodings and to locate and extract embedded executables.\n* [Spidermonkey](https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey) -\n  Mozilla's JavaScript engine, for debugging malicious JS.\n\n## File Carving\n\n*For extracting files from inside disk and memory images.*\n\n* [bulk_extractor](https://github.com/simsong/bulk_extractor) - Fast file\n  carving tool.\n* [EVTXtract](https://github.com/williballenthin/EVTXtract) - Carve Windows\n  Event Log files from raw binary data.\n* [Foremost](http://foremost.sourceforge.net/) - File carving tool designed\n  by the US Air Force.\n* [hachoir3](https://github.com/vstinner/hachoir3) - Hachoir is a Python library\n  to view and edit a binary stream field by field.\n* [Scalpel](https://github.com/sleuthkit/scalpel) - Another data carving\n  tool.\n* [SFlock](https://github.com/jbremer/sflock) - Nested archive\n  extraction/unpacking (used in Cuckoo Sandbox).\n\n## Deobfuscation\n\n*Reverse XOR and other code obfuscation methods.*\n\n* [Balbuzard](https://bitbucket.org/decalage/balbuzard/wiki/Home) - A malware\n  analysis tool for reversing obfuscation (XOR, ROL, etc) and more.\n* [de4dot](https://github.com/0xd4d/de4dot) - .NET deobfuscator and\n  unpacker.\n* [ex_pe_xor](http://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html)\n  \u0026 [iheartxor](http://hooked-on-mnemonics.blogspot.com/p/iheartxor.html) -\n  Two tools from Alexander Hanel for working with single-byte XOR encoded\n  files.\n* [FLOSS](https://github.com/fireeye/flare-floss) - The FireEye Labs Obfuscated\n  String Solver uses advanced static analysis techniques to automatically\n  deobfuscate strings from malware binaries.\n* [NoMoreXOR](https://github.com/hiddenillusion/NoMoreXOR) - Guess a 256 byte\n  XOR key using frequency analysis.\n* [PackerAttacker](https://github.com/BromiumLabs/PackerAttacker) - A generic\n  hidden code extractor for Windows malware.\n* [PyInstaller Extractor](https://github.com/extremecoders-re/pyinstxtractor) -\n  A Python script to extract the contents of a PyInstaller generated Windows\n  executable file. The contents of the pyz file (usually pyc files) present\n  inside the executable are also extracted and automatically fixed so that a\n  Python bytecode decompiler will recognize it.\n* [uncompyle6](https://github.com/rocky/python-uncompyle6/) - A cross-version\n  Python bytecode decompiler.  Translates Python bytecode back into equivalent\n  Python source code.\n* [un{i}packer](https://github.com/unipacker/unipacker) - Automatic and\n  platform-independent unpacker for Windows binaries based on emulation.\n* [unpacker](https://github.com/malwaremusings/unpacker/) - Automated malware\n  unpacker for Windows malware based on WinAppDbg.\n* [unxor](https://github.com/tomchop/unxor/) - Guess XOR keys using\n  known-plaintext attacks.\n* [VirtualDeobfuscator](https://github.com/jnraber/VirtualDeobfuscator) -\n  Reverse engineering tool for virtualization wrappers.\n* [XORBruteForcer](http://eternal-todo.com/var/scripts/xorbruteforcer) -\n  A Python script for brute forcing single-byte XOR keys.\n* [XORSearch \u0026 XORStrings](https://blog.didierstevens.com/programs/xorsearch/) -\n  A couple programs from Didier Stevens for finding XORed data.\n* [xortool](https://github.com/hellman/xortool) - Guess XOR key length, as\n  well as the key itself.\n\n## Debugging and Reverse Engineering\n\n*Disassemblers, debuggers, and other static and dynamic analysis tools.*\n\n* [angr](https://github.com/angr/angr) - Platform-agnostic binary analysis\n  framework developed at UCSB's Seclab.\n* [bamfdetect](https://github.com/bwall/bamfdetect) - Identifies and extracts\n  information from bots and other malware.\n* [BAP](https://github.com/BinaryAnalysisPlatform/bap) - Multiplatform and\n  open source (MIT) binary analysis framework developed at CMU's Cylab.\n* [BARF](https://github.com/programa-stic/barf-project) - Multiplatform, open\n  source Binary Analysis and Reverse engineering Framework.\n* [binnavi](https://github.com/google/binnavi) - Binary analysis IDE for\n  reverse engineering based on graph visualization.\n* [Binary ninja](https://binary.ninja/) - A reversing engineering platform\n  that is an alternative to IDA.\n* [Binwalk](https://github.com/devttys0/binwalk) - Firmware analysis tool.\n* [BluePill](https://github.com/season-lab/bluepill) - Framework for executing and debugging evasive malware and protected executables.\n* [Capstone](https://github.com/aquynh/capstone) - Disassembly framework for\n  binary analysis and reversing, with support for many architectures and\n  bindings in several languages.\n* [codebro](https://github.com/hugsy/codebro) - Web based code browser using\n  clang to provide basic code analysis.\n* [Cutter](https://github.com/radareorg/cutter) - GUI for Radare2.\n* [DECAF (Dynamic Executable Code Analysis Framework)](https://github.com/sycurelab/DECAF)\n  - A binary analysis platform based   on QEMU. DroidScope is now an extension to DECAF.\n* [dnSpy](https://github.com/0xd4d/dnSpy) - .NET assembly editor, decompiler\n  and debugger.\n* [dotPeek](https://www.jetbrains.com/decompiler/) - Free .NET Decompiler and\n  Assembly Browser.\n* [Evan's Debugger (EDB)](http://codef00.com/projects#debugger) - A\n  modular debugger with a Qt GUI.\n* [Fibratus](https://github.com/rabbitstack/fibratus) - Tool for exploration\n  and tracing of the Windows kernel.\n* [FPort](https://www.mcafee.com/us/downloads/free-tools/fport.aspx) - Reports\n  open TCP/IP and UDP ports in a live system and maps them to the owning application.\n* [GDB](http://www.sourceware.org/gdb/) - The GNU debugger.\n* [GEF](https://github.com/hugsy/gef) - GDB Enhanced Features, for exploiters\n  and reverse engineers.\n* [Ghidra](https://github.com/NationalSecurityAgency/ghidra) - A software reverse engineering (SRE) framework created and       maintained by the National Security Agency Research Directorate.\n* [hackers-grep](https://github.com/codypierce/hackers-grep) - A utility to\n  search for strings in PE executables including imports, exports, and debug\n  symbols.\n* [Hopper](https://www.hopperapp.com/) - The macOS and Linux Disassembler.\n* [IDA Pro](https://www.hex-rays.com/products/ida/index.shtml) - Windows\n  disassembler and debugger, with a free evaluation version.\n* [IDR](https://github.com/crypto2011/IDR) - Interactive Delphi Reconstructor\n  is a decompiler of Delphi executable files and dynamic libraries.\n* [Immunity Debugger](http://debugger.immunityinc.com/) - Debugger for\n  malware analysis and more, with a Python API.\n* [ILSpy](http://ilspy.net/) - ILSpy is the open-source .NET assembly browser and decompiler.\n* [Kaitai Struct](http://kaitai.io/) - DSL for file formats / network protocols /\n  data structures reverse engineering and dissection, with code generation\n  for C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.\n* [LIEF](https://lief.quarkslab.com/) - LIEF provides a cross-platform library\n  to parse, modify and abstract ELF, PE and MachO formats.\n* [ltrace](http://ltrace.org/) - Dynamic analysis for Linux executables.\n* [mac-a-mal](https://github.com/phdphuc/mac-a-mal) - An automated framework\n  for mac malware hunting.\n* [objdump](https://en.wikipedia.org/wiki/Objdump) - Part of GNU binutils,\n  for static analysis of Linux binaries.\n* [OllyDbg](http://www.ollydbg.de/) - An assembly-level debugger for Windows\n  executables.\n* [OllyDumpEx](https://low-priority.appspot.com/ollydumpex/) - Dump memory\n  from (unpacked) malware Windows process and store raw or rebuild PE file.\n  This is a plugin for OllyDbg, Immunity Debugger, IDA Pro, WinDbg, and x64dbg.\n* [PANDA](https://github.com/moyix/panda) - Platform for Architecture-Neutral\n  Dynamic Analysis.\n* [PEDA](https://github.com/longld/peda) - Python Exploit Development\n  Assistance for GDB, an enhanced display with added commands.\n* [pestudio](https://winitor.com/) - Perform static analysis of Windows\n  executables.\n* [Pharos](https://github.com/cmu-sei/pharos) - The Pharos binary analysis framework\n  can be used to perform automated static analysis of binaries.\n* [plasma](https://github.com/plasma-disassembler/plasma) - Interactive\n  disassembler for x86/ARM/MIPS.\n* [PPEE (puppy)](https://www.mzrst.com/) - A Professional PE file Explorer for\n  reversers, malware researchers and those who want to statically inspect PE\n  files in more detail.\n* [Process Explorer](https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer) -\n  Advanced task manager for Windows.\n* [Process Hacker](http://processhacker.sourceforge.net/) - Tool that monitors\n  system resources.\n* [Process Monitor](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) -\n  Advanced monitoring tool for Windows programs.\n* [PSTools](https://docs.microsoft.com/en-us/sysinternals/downloads/pstools) - Windows\n  command-line tools that help manage and investigate live systems.\n* [Pyew](https://github.com/joxeankoret/pyew) - Python tool for malware\n  analysis.\n* [PyREBox](https://github.com/Cisco-Talos/pyrebox) - Python scriptable reverse\n  engineering sandbox by the Talos team at Cisco.\n* [Qiling Framework](https://www.qiling.io/) - Cross platform emulation and sanboxing\n  framework with instruments for binary analysis.\n* [QKD](https://github.com/ispras/qemu/releases/) - QEMU with embedded WinDbg\n  server for stealth debugging.\n* [Radare2](http://www.radare.org/r/) - Reverse engineering framework, with\n  debugger support.\n* [RegShot](https://sourceforge.net/projects/regshot/) - Registry compare utility\n  that compares snapshots.\n* [RetDec](https://retdec.com/) - Retargetable machine-code decompiler with an\n  [online decompilation service](https://retdec.com/decompilation/) and\n  [API](https://retdec.com/api/) that you can use in your tools.\n* [ROPMEMU](https://github.com/Cisco-Talos/ROPMEMU) - A framework to analyze, dissect\n  and decompile complex code-reuse attacks.\n* [Scylla Imports Reconstructor](https://github.com/NtQuery/Scylla) - Find and fix\n  the IAT of an unpacked / dumped PE32 malware.\n* [ScyllaHide](https://github.com/x64dbg/ScyllaHide) - An Anti-Anti-Debug library\n  and plugin for OllyDbg, x64dbg, IDA Pro, and TitanEngine.\n* [SMRT](https://github.com/pidydx/SMRT) - Sublime Malware Research Tool, a\n  plugin for Sublime 3 to aid with malware analyis.\n* [strace](https://sourceforge.net/projects/strace/) - Dynamic analysis for\n  Linux executables.\n* [StringSifter](https://github.com/fireeye/stringsifter) - A machine learning tool\n  that automatically ranks strings based on their relevance for malware analysis.\n* [Triton](https://triton.quarkslab.com/) - A dynamic binary analysis (DBA) framework.\n* [Udis86](https://github.com/vmt/udis86) - Disassembler library and tool\n  for x86 and x86_64.\n* [Vivisect](https://github.com/vivisect/vivisect) - Python tool for\n  malware analysis.\n* [WinDbg](https://developer.microsoft.com/en-us/windows/hardware/download-windbg) - multipurpose debugger for the Microsoft Windows computer operating system, used to debug user mode applications, device drivers, and the kernel-mode memory dumps.\n* [X64dbg](https://github.com/x64dbg/) - An open-source x64/x32 debugger for windows.\n\n## Network\n\n*Analyze network interactions.*\n\n* [Bro](https://www.bro.org) - Protocol analyzer that operates at incredible\n  scale; both file and network protocols.\n* [BroYara](https://github.com/hempnall/broyara) - Use Yara rules from Bro.\n* [CapTipper](https://github.com/omriher/CapTipper) -  Malicious HTTP traffic\n  explorer.\n* [chopshop](https://github.com/MITRECND/chopshop) - Protocol analysis and\n  decoding framework.\n* [CloudShark](https://www.cloudshark.org) - Web-based tool for packet analysis\n  and malware traffic detection.\n* [FakeNet-NG](https://github.com/fireeye/flare-fakenet-ng) - Next generation\n  dynamic network analysis tool.\n* [Fiddler](https://www.telerik.com/fiddler) - Intercepting web proxy designed\n  for \"web debugging.\"\n* [Hale](https://github.com/pjlantz/Hale) - Botnet C\u0026C monitor.\n* [Haka](http://www.haka-security.org/) - An open source security oriented\n  language for describing protocols and applying security policies on (live)\n  captured traffic.\n* [HTTPReplay](https://github.com/jbremer/httpreplay) - Library for parsing\n  and reading out PCAP files, including TLS streams using TLS Master Secrets\n  (used in Cuckoo Sandbox).\n* [INetSim](http://www.inetsim.org/) - Network service emulation, useful when\n  building a malware lab.\n* [Laika BOSS](https://github.com/lmco/laikaboss) - Laika BOSS is a file-centric\n  malware analysis and intrusion detection system.\n* [Malcolm](https://github.com/idaholab/Malcolm) - Malcolm is a powerful, easily\n  deployable network traffic analysis tool suite for full packet capture artifacts\n  (PCAP files) and Zeek logs.\n* [Malcom](https://github.com/tomchop/malcom) - Malware Communications\n  Analyzer.\n* [Maltrail](https://github.com/stamparm/maltrail) - A malicious traffic\n  detection system, utilizing publicly available (black)lists containing\n  malicious and/or generally suspicious trails and featuring an reporting\n  and analysis interface.\n* [mitmproxy](https://mitmproxy.org/) - Intercept network traffic on the fly.\n* [Moloch](https://github.com/aol/moloch) - IPv4 traffic capturing, indexing\n  and database system.\n* [NetworkMiner](http://www.netresec.com/?page=NetworkMiner) - Network\n  forensic analysis tool, with a free version.\n* [ngrep](https://github.com/jpr5/ngrep) - Search through network traffic\n  like grep.\n* [PcapViz](https://github.com/mateuszk87/PcapViz) - Network topology and\n  traffic visualizer.\n* [Python ICAP Yara](https://github.com/RamadhanAmizudin/python-icap-yara) - An\n  ICAP Server with yara scanner for URL or content.\n* [Squidmagic](https://github.com/ch3k1/squidmagic) - squidmagic is a tool\n  designed to analyze a web-based network traffic to detect central command\n  and control (C\u0026C) servers and malicious sites, using Squid proxy server and\n  Spamhaus.\n* [Tcpdump](http://www.tcpdump.org/) - Collect network traffic.\n* [tcpick](http://tcpick.sourceforge.net/) - Trach and reassemble TCP streams\n  from network traffic.\n* [tcpxtract](http://tcpxtract.sourceforge.net/) - Extract files from network\n  traffic.\n* [Wireshark](https://www.wireshark.org/) - The network traffic analysis\n  tool.\n\n## Memory Forensics\n\n*Tools for dissecting malware in memory images or running systems.*\n\n* [BlackLight](https://www.blackbagtech.com/blacklight.html) - Windows/MacOS\n  forensics client supporting hiberfil, pagefile, raw memory analysis.\n* [DAMM](https://github.com/504ensicsLabs/DAMM) - Differential Analysis of\n  Malware in Memory, built on Volatility.\n* [evolve](https://github.com/JamesHabben/evolve) - Web interface for the\n  Volatility Memory Forensics Framework.\n* [FindAES](https://sourceforge.net/projects/findaes/) - Find AES\n  encryption keys in memory.\n* [inVtero.net](https://github.com/ShaneK2/inVtero.net) - High speed memory\n  analysis framework developed in .NET supports all Windows x64, includes\n  code integrity and write support.\n* [Muninn](https://github.com/ytisf/muninn) - A script to automate portions\n  of analysis using Volatility, and create a readable report.\n  [Orochi](https://github.com/LDO-CERT/orochi) - Orochi is an open source framework for \n  collaborative forensic memory dump analysis. \n* [Rekall](http://www.rekall-forensic.com/) - Memory analysis framework,\n  forked from Volatility in 2013.\n* [TotalRecall](https://github.com/sketchymoose/TotalRecall) - Script based\n  on Volatility for automating various malware analysis tasks.\n* [VolDiff](https://github.com/aim4r/VolDiff) - Run Volatility on memory\n  images before and after malware execution, and report changes.\n* [Volatility](https://github.com/volatilityfoundation/volatility) - Advanced\n  memory forensics framework.\n* [VolUtility](https://github.com/kevthehermit/VolUtility) - Web Interface for\n  Volatility Memory Analysis framework.\n* [WDBGARK](https://github.com/swwwolf/wdbgark) -\n  WinDBG Anti-RootKit Extension.\n* [WinDbg](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit) -\n  Live memory inspection and kernel debugging for Windows systems.\n\n## Windows Artifacts\n\n* [AChoir](https://github.com/OMENScan/AChoir) - A live incident response\n  script for gathering Windows artifacts.\n* [python-evt](https://github.com/williballenthin/python-evt) - Python\n  library for parsing Windows Event Logs.\n* [python-registry](http://www.williballenthin.com/registry/) - Python\n  library for parsing registry files.\n* [RegRipper](http://brettshavers.cc/index.php/brettsblog/tags/tag/regripper/)\n  ([GitHub](https://github.com/keydet89/RegRipper2.8)) -\n  Plugin-based registry analysis tool.\n\n## Storage and Workflow\n\n* [Aleph](https://github.com/merces/aleph) - Open Source Malware Analysis\n  Pipeline System.\n* [CRITs](https://crits.github.io/) - Collaborative Research Into Threats, a\n  malware and threat repository.\n* [FAME](https://certsocietegenerale.github.io/fame/) - A malware analysis\n  framework featuring a pipeline that can be extended with custom modules,\n  which can be chained and interact with each other to perform end-to-end\n  analysis.\n* [Malwarehouse](https://github.com/sroberts/malwarehouse) - Store, tag, and\n  search malware.\n* [Polichombr](https://github.com/ANSSI-FR/polichombr) - A malware analysis\n  platform designed to help analysts to reverse malwares collaboratively.\n* [stoQ](http://stoq.punchcyber.com) - Distributed content analysis\n  framework with extensive plugin support, from input to output, and everything\n  in between.\n* [Viper](http://viper.li/) - A binary management and analysis framework for\n  analysts and researchers.\n\n## Miscellaneous\n\n* [al-khaser](https://github.com/LordNoteworthy/al-khaser) - A PoC malware\n  with good intentions that aimes to stress anti-malware systems.\n* [CryptoKnight](https://github.com/AbertayMachineLearningGroup/CryptoKnight) - Automated cryptographic algorithm reverse engineering and classification framework.\n* [DC3-MWCP](https://github.com/Defense-Cyber-Crime-Center/DC3-MWCP) -\n  The Defense Cyber Crime Center's Malware Configuration Parser framework.\n* [FLARE VM](https://github.com/fireeye/flare-vm) - A fully customizable,\n  Windows-based, security distribution for malware analysis.\n* [MalSploitBase](https://github.com/misterch0c/malSploitBase) - A database\n  containing exploits used by malware.\n* [Malware Museum](https://archive.org/details/malwaremuseum) - Collection of\n  malware programs that were distributed in the 1980s and 1990s.\n* [Malware Organiser](https://github.com/uppusaikiran/malware-organiser) - A simple tool to organise large malicious/benign files into a organised Structure.\n* [Pafish](https://github.com/a0rtega/pafish) - Paranoid Fish, a demonstration\n  tool that employs several techniques to detect sandboxes and analysis\n  environments in the same way as malware families do.\n* [REMnux](https://remnux.org/) - Linux distribution and docker images for\n  malware reverse engineering and analysis.\n* [Tsurugi Linux](https://tsurugi-linux.org/) - Linux distribution designed to support your DFIR investigations, malware analysis and OSINT (Open Source INTelligence) activities.\n* [Santoku Linux](https://santoku-linux.com/) - Linux distribution for mobile\n  forensics, malware analysis, and security.\n\n# Resources\n\n## Books\n\n*Essential malware analysis reading material.*\n\n* [Learning Malware Analysis](https://www.packtpub.com/networking-and-servers/learning-malware-analysis) - Learning Malware Analysis: Explore the concepts, tools, and techniques to analuze and investigate Windows malware\n* [Malware Analyst's Cookbook and DVD](https://amzn.com/dp/0470613033) -\n  Tools and Techniques for Fighting Malicious Code.\n* [Mastering Malware Analysis](https://www.packtpub.com/networking-and-servers/mastering-malware-analysis) - Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercime, and IoT attacks\n* [Mastering Reverse Engineering](https://www.packtpub.com/networking-and-servers/mastering-reverse-engineering) - Mastering Reverse Engineering: Re-engineer your ethical hacking skills\n* [Practical Malware Analysis](https://amzn.com/dp/1593272901) - The Hands-On\n  Guide to Dissecting Malicious Software.\n* [Practical Reverse Engineering](https://www.amzn.com/dp/1118787315/) -\n  Intermediate Reverse Engineering.\n* [Real Digital Forensics](https://www.amzn.com/dp/0321240693) - Computer\n  Security and Incident Response.\n* [Rootkits and Bootkits](https://www.amazon.com/dp/1593277164) - Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats\n* [The Art of Memory Forensics](https://amzn.com/dp/1118825098) - Detecting\n  Malware and Threats in Windows, Linux, and Mac Memory.\n* [The IDA Pro Book](https://amzn.com/dp/1593272898) - The Unofficial Guide\n  to the World's Most Popular Disassembler.\n* [The Rootkit Arsenal](https://amzn.com/dp/144962636X) - The Rootkit Arsenal:\n  Escape and Evasion in the Dark Corners of the System\n\n## Other\n\n* [APT Notes](https://github.com/aptnotes/data) - A collection of papers\n  and notes related to Advanced Persistent Threats.\n* [Ember](https://github.com/endgameinc/ember) - Endgame Malware BEnchmark for Research,\n  a repository that makes it easy to (re)create a machine learning model that can be used\n  to predict a score for a PE file based on static analysis.\n* [File Formats posters](https://github.com/corkami/pics) - Nice visualization\n  of commonly used file format (including PE \u0026 ELF).\n* [Honeynet Project](http://honeynet.org/) - Honeypot tools, papers, and\n  other resources.\n* [Kernel Mode](http://www.kernelmode.info/forum/) - An active community\n  devoted to malware analysis and kernel development.\n* [Malicious Software](https://zeltser.com/malicious-software/) - Malware\n  blog and resources by Lenny Zeltser.\n* [Malware Analysis Search](https://cse.google.com/cse/home?cx=011750002002865445766%3Apc60zx1rliu) -\n  Custom Google search engine from [Corey Harrell](journeyintoir.blogspot.com/).\n* [Malware Analysis Tutorials](http://fumalwareanalysis.blogspot.nl/p/malware-analysis-tutorials-reverse.html) -\n  The Malware Analysis Tutorials by Dr. Xiang Fu, a great resource for learning\n  practical malware analysis.\n* [Malware Analysis, Threat Intelligence and Reverse Engineering](https://www.slideshare.net/bartblaze/malware-analysis-threat-intelligence-and-reverse-engineering) -\n  Presentation introducing the concepts of malware analysis, threat intelligence\n  and reverse engineering. Experience or prior knowledge is not required. Labs\n  link in description.\n* [Malware Persistence](https://github.com/Karneades/malware-persistence) - Collection\n  of various information focused on malware persistence: detection (techniques),\n  response, pitfalls and the log collection (tools).\n* [Malware Samples and Traffic](http://malware-traffic-analysis.net/) - This\n  blog focuses on network traffic related to malware infections.\n* [Malware Search+++](https://addons.mozilla.org/fr/firefox/addon/malware-search-plusplusplus/) Firefox extension allows\n  you to easily search some of the most popular malware databases\n* [Practical Malware Analysis Starter Kit](https://bluesoul.me/practical-malware-analysis-starter-kit/) -\n  This package contains most of the software referenced in the Practical Malware\n  Analysis book.\n* [RPISEC Malware Analysis](https://github.com/RPISEC/Malware) - These are the\n  course materials used in the Malware Analysis course at at Rensselaer Polytechnic\n  Institute during Fall 2015.\n* [WindowsIR: Malware](http://windowsir.blogspot.com/p/malware.html) - Harlan\n  Carvey's page on Malware.\n* [Windows Registry specification](https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md) -\n  Windows registry file format specification.\n* [/r/csirt_tools](https://www.reddit.com/r/csirt_tools/) - Subreddit for CSIRT\n  tools and resources, with a\n  [malware analysis](https://www.reddit.com/r/csirt_tools/search?q=flair%3A%22Malware%20analysis%22\u0026sort=new\u0026restrict_sr=on) flair.\n* [/r/Malware](https://www.reddit.com/r/Malware) - The malware subreddit.\n* [/r/ReverseEngineering](https://www.reddit.com/r/ReverseEngineering) -\n  Reverse engineering subreddit, not limited to just malware.\n\n\n\n# Related Awesome Lists\n\n* [Android Security](https://github.com/ashishb/android-security-awesome)\n* [AppSec](https://github.com/paragonie/awesome-appsec)\n* [CTFs](https://github.com/apsdehal/awesome-ctf)\n* [Executable Packing](https://github.com/dhondta/awesome-executable-packing)\n* [Forensics](https://github.com/Cugu/awesome-forensics)\n* [\"Hacking\"](https://github.com/carpedm20/awesome-hacking)\n* [Honeypots](https://github.com/paralax/awesome-honeypots)\n* [Industrial Control System Security](https://github.com/hslatman/awesome-industrial-control-system-security)\n* [Incident-Response](https://github.com/meirwah/awesome-incident-response)\n* [Infosec](https://github.com/onlurking/awesome-infosec)\n* [PCAP Tools](https://github.com/caesar0301/awesome-pcaptools)\n* [Pentesting](https://github.com/enaqx/awesome-pentest)\n* [Security](https://github.com/sbilly/awesome-security)\n* [Threat Intelligence](https://github.com/hslatman/awesome-threat-intelligence)\n* [YARA](https://github.com/InQuest/awesome-yara)\n\n# [Contributing](CONTRIBUTING.md)\n\nPull requests and issues with suggestions are welcome! Please read the\n[CONTRIBUTING](CONTRIBUTING.md) guidelines before submitting a PR.\n\n# Thanks\n\nThis list was made possible by:\n\n* Lenny Zeltser and other contributors for developing REMnux, where I\n  found many of the tools in this list;\n* Michail Hale Ligh, Steven Adair, Blake Hartstein, and Mather Richard for\n  writing the *Malware Analyst's Cookbook*, which was a big inspiration for\n  creating the list;\n* And everyone else who has sent pull requests or suggested links to add here!\n\nThanks!\n","funding_links":["https://ko-fi.com/rshipp"],"categories":["Awesome Lists","Hacking and Pentesting","Related Lists","Security","Technical","Other Awesome Security Lists","Resources","Related Awesome Lists","Uncategorized","Networking and Security","Audi-1's SQLi-LABS","\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","Go","Malware Analysis","Other Awesome Lists","Coordinated disclosure","Others","Others (1002)","Infosec resources","miscellaneous","Online Resources","Books","Table of Contents","🔐 Security","Technologies","HarmonyOS","Live Site:   [searchAwesome](https://search-awesome.vercel.app/)","Resource","Awesome Penetration Testing","Awesome Repositories","杀毒免杀、逆向工程","[↑](#-table-of-contents) Related Awesome Lists","Awesome Penetration Testing (\"https://github.com/Muhammd/Awesome-Pentest\")","Responsible disclosure","chinese","Awesome lists","AWESOME LISTS","Source","安全","Here is a collection of hackers, pentesters, security researchers, scripts and more:","Other Lists","📘 Valuable Repositories","Endpoint","Other Security Awesome Lists","Themed Directories","Programming/Comp Sci/SE Things"],"sub_categories":["Defcon Suggested Reading","Secure OSes","awesome-*","Cloud","Related Awesome Lists","Uncategorized","CTF Courses","Episodes","Hashing","Other Security Awesome Lists","JavaScript","Other","CTF Repos","ColdFusion","Other Lists Online","Malware Analysis Books","Awesome Repos","Windows Manager","✨  Other","Labs","Awesome Lists","网络服务_其他","[↑](#-table-of-contents) Telegram","Awesome Repositories","Other Resources","TeX Lists","Anti-Virus / Anti-Malware","Indicators Of Compromise Searching","Wifi Tools"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frshipp%2Fawesome-malware-analysis","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frshipp%2Fawesome-malware-analysis","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frshipp%2Fawesome-malware-analysis/lists"}