Malware Reversing

• Static Analysis

  • **OLEVBA** - Extracts VBA macros from Office files and detects obfuscation techniques.
  • **md5sum** - Compute and check MD5 message digest.
  • **HashMyFile** - Calculates MD5 and SHA1 hashes of one or more files.
  • **Hasher** - Free SHA-1, MD5, and CRC32 hash generator for Windows.
  • **strings** - Print sequences of printable characters in files.
  • **binText** - Extracts ASCII, Unicode, and Resource strings from files.
  • **StringsDump** - Extracts and identifies text from binary files.
  • **yara** - Tool for identifying and classifying malware samples.
  • **file** - Determine file type.
  • **exeinfo PE** - Analyze Windows PE header information, packer detection, and gives hints on how to unpack.
  • **trID** - Use pattern database to determine file types, gives a likelihood of detected type.
  • **PeiD** - Detects common packers, cryptors, and compilers for PE files.
  • **Detect-It-Easy** - Determines types of files for Windows, Linux, and MacOS.
  • **KAPE** - A tool for acquiring and processing forensic artifacts.
  • **ssdeep** - Computes context triggered piecewise hashes (CTPH) for fuzzy matching.
  • **impfuzzy** - Calculates Fuzzy Hash from import API of PE files.
  • **pehash** - Compilation of peHash implementations.
  • **VHash** - Computes hashes for files with support for various hashing algorithms.
  • **PeStudio** - Examines executable files in depth.
  • **PE Explorer** - Inspects Windows applications and libraries.
  • **PE Bear** - Multiplatform reversing tool for PE files.
  • **Peview** - Lightweight utility for inspecting PE files.
  • **Dependency Walker** - Builds hierarchical tree diagram of dependent modules.
  • **DLL Export Viewer** - Displays exported functions and their addresses for DLL files.
  • **PEPack** - Python library for inspecting and manipulating PE files.
  • **Loki** - IOC and YARA Scanner.
  • **spidermonkey** - Modified Mozilla JavaScript implementation for malware analysis.
  • **ComputeHash** - Calculates MD5, SHA1, SHA256, SHA384, and SHA512 hashes.
  • **GET-FileHash** - Computes hash value for a file using a specified hash algorithm.
  • **floss64** - Automatically extracts obfuscated strings from malware.
  • **zipdump** - Analyzes zip files and runs YARA rules.
  • **pee-pdf** - Analyzes PDF documents.
  • **pdfunite** - Merges multiple PDF files into a single file.
  • **officeMalScanner** - Scans MS Office documents for malicious traces.
  • **vipermonkey** - VBA parser and emulation engine.
  • **OfficeScan** - Analyzes Microsoft Office documents for malware and other threats.
  • **Pefish** - Detects virtual machines and malware analysis environments.
  • **lazy office analyzer** - Extracts URLs, VB-script, and JavaScript from Office documents.
  • **VMProtect** - Anti-debugging and anti-VM software protection.