:bookmark_tabs: Datasets

Scientific Research

• CyberCrime - C² tracking and malware database.
• The Malware Museum - Collection of malware programs, usually viruses, that were distributed in the 1980s and 1990s on home computers.
• Open Malware Project - Online collection of malware samples (formerly Offensive Computing).
• Runtime Packers Testset - Dataset of 10 common Malware files, packed with about 40 different runtime packers in over 500 versions and options, with a total of about 5,000 samples.
• SAC - Slovak Antivirus Center, non-commercial project of AVIR and ESET companies ; contains packers, detectors and unpackers.
• VX Heaven - Site dedicated to providing information about computer viruses.
• MalwareSamples - Bringing you the best of the worst files on the Internet.
• Ember - Collection of features from PE files that serve as a benchmark dataset for researchers.
• FFRI Dataset Scripts - Make datasets like FFRI Dataset.
• MaleX - Curated dataset of malware and benign Windows executable samples for malware researchers containing 1,044,394 Windows executable binaries and corresponding image representations with 864,669 labelled as malware and 179,725 as benign.
• PackingData - Original dataset with sample PE files packed with a large variety of packers, including ASPack, BeRoEXEPacker, exe32pack, eXpressor, FSG, JDPack, MEW, Molebox, MPRESS, Neolite, NSPack, Pckman, PECompact, PEtite, RLPack, UPX, WinUpack, Yoda's Crypter and Yoda's Protector.
• Packware - Datasets and codes that are needed to reproduce the experiments in the paper "When Malware is Packing Heat".
• RCE Lab - Crackme's, keygenme's, serialme's ; the "tuts4you" folder contains many packed binaries.
• theZoo - Project created to make the possibility of malware analysis open and available to the public.
• BODMAS - Code for our DLS'21 paper - BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware.
• Malicia - Dataset of 11,688 malicous PE files collected from 500 drive-by download servers over a period of 11 months in 2013 (DISCONTINUED).
• Malware Archive - Malware samples, analysis exercises and other interesting resources.
• ViruSign - Another online malware database.
• VirusShare - Virus online database with more than 44 millions of samples.
• VirusTotal - File analysis Web service for detecting malware.
• VX Underground - PL-CERT based open source MWDB python application holding a malware database containing every APT sample from 2010 and over 7.5M maliciousbinaries.
• VXvault - Online malware database.
• WildList - Cooperative listing of malwares reported as being in the wild by security professionals.
• MalShare - Free Malware repository providing researchers access to samples, malicious feeds, and Yara results.
• Malfease - Dataset of about 5,000 packed malware samples.
• SOREL - Sophos-ReversingLabs 20 Million dataset.
• Ember2024 - Update to the EMBER2017 and EMBER2018 datasets.
• Contagio - Collection of the latest malware samples, threats, observations, and analyses.
• MalwareTips - Community-driven platform providing the latest information and resources on malware and cyber threats.
• OARC Malware Dataset - Semi-public dataset of 3,467 samples captured in the wild from Sep 2005 to Jan 2006 by mail traps, user submissions, honeypots and other sources aggregated by the OARC, available to qualified academic and industry researchers upon request.
• VirusSamples - Best of the worst kind of files on the Internet.
• VirusSign - Giant database dedicated to combating malware in the digital world.
• MalwareBazaar - Project operated by abuse.ch aimed to collect and share malware samples, helping IT-security researchers and threat analysts protecting their constituency and customers from cyber threats.

:books: Literature

Documentation

• A.out binary format
• Android packers: Separating from the pack
• Anti debugging protection techniques with examples
• Anti-unpacker tricks
• API deobfuscator: Resolving obfuscated API functions in modern packers
• The art of unpacking
• COM binary format
• Common object file format (COFF)
• Comparison of executable file formats
• Entropy and the distinctive signs of packer PE files
• Executable and linkable format (ELF)
• Executable and linking format (ELF) specification
• Hyperion: Implementation of a PE-Crypter
• Mach-O internals
• Making our own executable packer
• Microsoft portable executable and common object file format specification
• MZ disk operating system (DOS)
• One packer to rule them all: Empirical identification, comparison and circumvention of current antivirus detection techniques
• One packer to rule them all: Empirical identification, comparison and circumvention of current antivirus detection techniques
• Packers
• PE format - Win32 apps
• PinDemonium: A DBI-based generic unpacker for Windows executables
• Portable executable (PE)
• Reverse engineering malware: Binary obfuscation and protection
• Runtime packers: The hidden problem?
• Tuts 4 you - UnPackMe (.NET)
• Tuts 4 you | unpackme
• The "Ultimate" anti-debugging reference
• Virtual machine obfuscation
• We can still crack you! General unpacking method for Android Packer (NO ROOT)
• When malware is packing heat
• Win32 portable executable packing uncovered
• Evading machine learning malware detection
• Gunpack: Un outil générique d'unpacking de malwares
• Mach-O file format reference
• Packer detection tool evaluation
• Clustering algorithms
• A complexity measure
• Cyclomatic complexity density and software maintenance productivity
• Do we need hundreds of classifiers to solve real world classification problems?
• On the worst-case complexity of timsort
• Packing-box: Breaking detectors & visualizing packing
• A survey of dimensionality reduction techniques
• x86 disassembly/Windows executable files
• Feature selection: A data perspective
• Pattern recognition and machine learning (Information science and statistics)
• ProtectMyTooling - Don't detect tools, detect techniques
• Cloak and dagger: Unpacking hidden malware attacks
• Awesome LLVM security
• Defacto2
• Explained: Packer, crypter, and protector
• NotPacked++: Evading static packing detection
• OllyDbg OEP finder scripts
• Packing-box: Improving detection of executable packing
• Unpacking binary 101
• Unpacking the potential of "Packing box"
• Unpacking, reversing, patching
• Writing a PE packer
• Dealing with virtualization packers
• Qualitative and quantitative evaluation of software packers
• Standards and policies on packer use
• The matthews correlation coefficient (MCC) should replace the ROC AUC as the standard metric for assessing binary classification
• The art of memory forensics: Detecting malware and threats in Windows, Linux, and mac memory
• Practical malware analysis: The hands-on guide to dissecting malicious software
• Armouring the ELF: Binary encryption on the UNIX platform
• Learn symbolic execution and angr
• LIEF: Library to instrument executable formats
• The malware analyst's guide to aPLib decompression
• Packers/Protectors for Linux
• Packing-box: Playing with executable packing
• Runtime packers testing experiences
• TitanMist: Your first step to reversing nirvana
• Cluster analysis
• Executable file formats
• Machine learning
• About anti-debug tricks
• a.out (FreeBSD manual pages)
• Anti-unpacker tricks - Part 14 (and previous parts)
• Dynamic binary analysis and obfuscated codes
• elf (FreeBSD manual pages)
• FatELF: Universal binaries for Linux (HALTED)
• How to use t-SNE effectively
• Implementing your own generic unpacker
• Mach-O - A look at apple executable files
• MITRE ATT&CK | T1027.002 | obfuscated files or information: Software packing - Enterprise
• MITRE ATT&CK | T1406.002 | obfuscated files or information: Software packing - Mobile
• Packer analysis report debugging and unpacking the NsPack 3.4 and 3.7 packer
• Parsing mach-O files
• WaveAtlas: Surfing through the landscape of current malware packers
• Writing a packer
• Writing a simple PE packer in detail
• YARA - The pattern matching swiss knife for malware researchers.

Scientific Research

• Absent extreme learning machine algorithm with application to packed executable identification
• An accurate packer identification method using support vector machine
• Adaptive unpacking of Android Apps
• Application of string kernel based support vector machine for malware packer identification
• The application research of virtual machine in packers
• The arms race: Adversarial search defeats entropy used to detect malware
• Automatic static unpacking of malware binaries
• BareUnpack: Generic unpacking on the bare-metal operating system
• BinStat tool for recognition of packed executables
• Boosting scalability in anomaly-based packed executable filtering
• Challenging anti-virus through evolutionary malware obfuscation
• Classifying packed malware represented as control flow graphs using deep graph convolutional neural network
• Classifying packed programs as malicious software detected
• A comparative analysis of classifiers in the recognition of packed executables
• A comparative analysis of software protection schemes
• Comparing malware samples for unpacking: A feasibility study
• A consistently-executing graph-based approach for malware packer identification
• A control flow graph-based signature for packer identification
• Countering entropy measure attacks on packed software detection
• Deobfuscation of packed and virtualization-obfuscation protected binaries
• Design and development of a new scanning core engine for malware detection
• Design and performance evaluation of binary code packing for protecting embedded software against reverse engineering
• Detecting packed executable file: Supervised or anomaly detection method?
• Detecting packed executables based on raw binary data
• Detecting packed executables using steganalysis
• Detecting packed PE files: Executable file analysis for the Windows operating system
• Detection of packed executables using support vector machines
• Disabling anti-debugging techniques for unpacking system in user-level debugger
• Dynamic classification of packing algorithms for inspecting executables using entropy analysis
• An efficient block-discriminant identification of packed malware
• Efficient malware packer identification using support vector machines with spectrum kernel
• Efficient SVM based packer identification with binary diffing measures
• EMBER: An open dataset for training static PE malware machine learning models
• An empirical evaluation of an unpacking method implemented with dynamic binary instrumentation
• Encoded executable file detection technique via executable file header analysis
• Eureka: A framework for enabling static malware analysis
• Experimental comparison of machine learning models in malware packing detection
• A fast randomness test that preserves local detail
• Feature set reduction for the detection of packed executables
• A generic approach to automatic deobfuscation of executable code
• Generic packing detection using several complexity analysis for accurate malware detection
• Generic unpacker of executable files
• Generic unpacking of self-modifying, aggressive, packed binary programs
• Generic unpacking techniques
• Generic unpacking using entropy analysis
• A heuristic approach for detection of obfuscated malware
• An implementation of a generic unpacking method on Bochs Emulator
• Instructions-based detection of sophisticated obfuscation and packing
• A learning model to detect maliciousness of portable executable using integrated feature set
• Limits of static analysis for malware detection
• Mal-EVE: Static detection model for evasive malware
• Malware analysis using multiple API sequence mining control flow graph
• Malware analysis using visualized images and entropy graphs
• Malware obfuscation techniques: A brief survey
• Malwise - An effective and efficient classification system for packed and polymorphic malware
• McBoost: Boosting scalability in malware collection and analysis using statistical classification of executables
• Memory behavior-based automatic malware unpacking in stealth debugging environment
• Modern Linux malware exposed
• MutantX-S: Scalable malware clustering based on static features
• The new signature generation method based on an unpacking algorithm and procedure for a packer detection
• Obfuscation-resilient executable payload extraction from packed malware
• Obfuscation: The hidden malware
• OmniUnpack: Fast, generic, and safe unpacking of malware
• An original entry point detection method with candidate-sorting for more effective generic unpacking
• Packed malware detection using entropy related analysis: A survey
• Packed malware variants detection using deep belief networks
• Packed PE file detection for malware forensics
• Packer detection for multi-layer executables using entropy analysis
• Packer identification method based on byte sequences
• Packer-complexity analysis in PANDA
• Packing detection and classification relying on machine learning to stop malware propagation
• Pandora's Bochs: Automatic unpacking of malware
• PE file features in detection of packed executables
• PE file header analysis-based packed PE file detection technique (PHAD)
• PE-Probe: Leveraging packer detection and structural information to detect malicious portable executables