[38;5;12m                             [39m[38;2;255;187;0m[1m[4mAwesome Malware Analysis [0m[38;5;14m[1m[4m![0m[38;2;255;187;0m[1m[4mAwesome[0m[38;5;14m[1m[4m (https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)[0m[38;2;255;187;0m[1m[4m (https://github.com/sindresorhus/awesome)[0m

[38;5;12mA curated list of awesome malware analysis tools and resources. Inspired by[39m
[38;5;14m[1mawesome-python[0m[38;5;12m (https://github.com/vinta/awesome-python) and[39m
[38;5;14m[1mawesome-php[0m[38;5;12m (https://github.com/ziadoz/awesome-php).[39m

[38;5;14m[1m![0m[38;5;12mDrop ICE[39m[38;5;14m[1m (drop.png)[0m[38;5;12m (https://twitter.com/githubbers/status/1182017616740663296)[39m

[38;5;12m- [39m[38;5;14m[1mMalware Collection[0m[38;5;12m (#malware-collection)[39m
[48;5;235m[38;5;249m- **Anonymizers** (#anonymizers)[49m[39m[48;5;235m[38;5;249m        [49m[39m
[48;5;235m[38;5;249m- **Honeypots** (#honeypots)[49m[39m[48;5;235m[38;5;249m            [49m[39m
[48;5;235m[38;5;249m- **Malware Corpora** (#malware-corpora)[49m[39m
[38;5;12m- [39m[38;5;14m[1mOpen Source Threat Intelligence[0m[38;5;12m (#open-source-threat-intelligence)[39m
[48;5;235m[38;5;249m- **Tools** (#tools)[49m[39m[48;5;235m[38;5;249m                    [49m[39m
[48;5;235m[38;5;249m- **Other Resources** (#other-resources)[49m[39m
[38;5;12m- [39m[38;5;14m[1mDetection and Classification[0m[38;5;12m (#detection-and-classification)[39m
[38;5;12m- [39m[38;5;14m[1mOnline Scanners and Sandboxes[0m[38;5;12m (#online-scanners-and-sandboxes)[39m
[38;5;12m- [39m[38;5;14m[1mDomain Analysis[0m[38;5;12m (#domain-analysis)[39m
[38;5;12m- [39m[38;5;14m[1mBrowser Malware[0m[38;5;12m (#browser-malware)[39m
[38;5;12m- [39m[38;5;14m[1mDocuments and Shellcode[0m[38;5;12m (#documents-and-shellcode)[39m
[38;5;12m- [39m[38;5;14m[1mFile Carving[0m[38;5;12m (#file-carving)[39m
[38;5;12m- [39m[38;5;14m[1mDeobfuscation[0m[38;5;12m (#deobfuscation)[39m
[38;5;12m- [39m[38;5;14m[1mDebugging and Reverse Engineering[0m[38;5;12m (#debugging-and-reverse-engineering)[39m
[38;5;12m- [39m[38;5;14m[1mNetwork[0m[38;5;12m (#network)[39m
[38;5;12m- [39m[38;5;14m[1mMemory Forensics[0m[38;5;12m (#memory-forensics)[39m
[38;5;12m- [39m[38;5;14m[1mWindows Artifacts[0m[38;5;12m (#windows-artifacts)[39m
[38;5;12m- [39m[38;5;14m[1mStorage and Workflow[0m[38;5;12m (#storage-and-workflow)[39m
[38;5;12m- [39m[38;5;14m[1mMiscellaneous[0m[38;5;12m (#miscellaneous)[39m
[38;5;12m- [39m[38;5;14m[1mResources[0m[38;5;12m (#resources)[39m
[48;5;235m[38;5;249m- **Books** (#books)[49m[39m
[48;5;235m[38;5;249m- **Other** (#other)[49m[39m
[38;5;12m- [39m[38;5;14m[1mRelated Awesome Lists[0m[38;5;12m (#related-awesome-lists)[39m
[38;5;12m- [39m[38;5;14m[1mContributing[0m[38;5;12m (#contributing)[39m
[38;5;12m- [39m[38;5;14m[1mThanks[0m[38;5;12m (#thanks)[39m

[38;5;12mView Chinese translation: [39m[38;5;14m[1m恶意软件分析大合集.md[0m[38;5;12m (恶意软件分析大合集.md).[39m

[38;5;238m――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――[39m

[38;2;255;187;0m[4mMalware Collection[0m

[38;2;255;187;0m[4mAnonymizers[0m

[48;2;30;30;40m[38;5;13m[3mWeb traffic anonymizers for analysts.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAnonymouse.org[0m[38;5;12m (http://anonymouse.org/) - A free, web based anonymizer.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOpenVPN[0m[38;5;12m (https://openvpn.net/) - VPN software and hosting solutions.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPrivoxy[0m[38;5;12m (http://www.privoxy.org/) - An open source proxy server with some[39m
[38;5;12m  privacy features.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTor[0m[38;5;12m (https://www.torproject.org/) - The Onion Router, for browsing the web[39m
[38;5;12m  without leaving traces of the client IP.[39m

[38;2;255;187;0m[4mHoneypots[0m

[48;2;30;30;40m[38;5;13m[3mTrap and collect your own samples.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mConpot[0m[38;5;12m (https://github.com/mushorg/conpot) - ICS/SCADA honeypot.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCowrie[0m[38;5;12m (https://github.com/micheloosterhof/cowrie) - SSH honeypot, based[39m
[38;5;12m  on Kippo.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDemoHunter[0m[38;5;12m (https://github.com/RevengeComing/DemonHunter) - Low interaction Distributed Honeypots.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDionaea[0m[38;5;12m (https://github.com/DinoTools/dionaea) - Honeypot designed to trap malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mGlastopf[0m[38;5;12m (https://github.com/mushorg/glastopf) - Web application honeypot.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneyd[0m[38;5;12m (http://www.honeyd.org/) - Create a virtual honeynet.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneyDrive[0m[38;5;12m (http://bruteforcelab.com/honeydrive) - Honeypot bundle Linux distro.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneytrap[0m[38;5;12m (https://github.com/honeytrap/honeytrap) - Opensource system for running, monitoring and managing honeypots.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMHN[0m[38;5;12m (https://github.com/pwnlandia/mhn) - MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMnemosyne[0m[38;5;12m (https://github.com/johnnykv/mnemosyne) - A normalizer for[39m
[38;5;12m  honeypot data; supports Dionaea.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThug[0m[38;5;12m (https://github.com/buffer/thug) - Low interaction honeyclient, for[39m
[38;5;12m  investigating malicious websites.[39m


[38;2;255;187;0m[4mMalware Corpora[0m

[48;2;30;30;40m[38;5;13m[3mMalware samples collected for analysis.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mClean MX[0m[38;5;12m (http://support.clean-mx.de/clean-mx/viruses.php) - Realtime[39m
[38;5;12m  database of malware and malicious domains.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mContagio[0m[38;5;12m (http://contagiodump.blogspot.com/) - A collection of recent[39m
[38;5;12m  malware samples and analyses.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mExploit Database[0m[38;5;12m (https://www.exploit-db.com/) - Exploit and shellcode[39m
[38;5;12m  samples.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInfosec - CERT-PA[0m[38;5;12m (https://infosec.cert-pa.it/analyze/submission.html) - Malware samples collection and analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInQuest Labs[0m[38;5;12m (https://labs.inquest.net) - Evergrowing searchable corpus of malicious Microsoft documents.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJavascript Mallware Collection[0m[38;5;12m (https://github.com/HynekPetrak/javascript-malware-collection) - Collection of almost 40.000 javascript malware samples[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalpedia[0m[38;5;12m (https://malpedia.caad.fkie.fraunhofer.de/) - A resource providing[39m
[38;5;12m  rapid identification and actionable context for malware investigations.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalshare[0m[38;5;12m (https://malshare.com) - Large repository of malware actively[39m
[38;5;12m  scrapped from malicious sites.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOpen Malware Project[0m[38;5;12m (http://openmalware.org/) - Sample information and[39m
[38;5;12m  downloads. Formerly Offensive Computing.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRagpicker[0m[38;5;12m (https://github.com/robbyFux/Ragpicker) - Plugin based malware[39m
[38;5;12m  crawler with pre-analysis and reporting functionalities[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mtheZoo[0m[38;5;12m (https://github.com/ytisf/theZoo) - Live malware samples for[39m
[38;5;12m  analysts.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTracker h3x[0m[38;5;12m (http://tracker.h3x.eu/) - Agregator for malware corpus tracker[39m
[38;5;12m  and malicious download sites.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mvduddu malware repo[0m[38;5;12m (https://github.com/vduddu/Malware) - Collection of[39m
[38;5;12m  various malware files and source code.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVirusBay[0m[38;5;12m (https://beta.virusbay.io/) - Community-Based malware repository and social network.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mViruSign[0m[38;5;12m (http://www.virussign.com/) - Malware database that detected by[39m
[38;5;12m  many anti malware programs except ClamAV.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVirusShare[0m[38;5;12m (https://virusshare.com/) - Malware repository, registration[39m
[38;5;12m  required.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVX Vault[0m[38;5;12m (http://vxvault.net) - Active collection of malware samples.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZeltser's Sources[0m[38;5;12m (https://zeltser.com/malware-sample-sources/) - A list[39m
[38;5;12m  of malware sample sources put together by Lenny Zeltser.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZeus Source Code[0m[38;5;12m (https://github.com/Visgean/Zeus) - Source for the Zeus[39m
[38;5;12m  trojan leaked in 2011.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVX Underground[0m[38;5;12m (http://vx-underground.org/) - Massive and growing collection of free malware samples.[39m

[38;2;255;187;0m[4mOpen Source Threat Intelligence[0m

[38;2;255;187;0m[4mTools[0m

[48;2;30;30;40m[38;5;13m[3mHarvest and analyze IOCs.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAbuseHelper[0m[38;5;12m (https://github.com/abusesa/abusehelper) - An open-source[39m
[38;5;12m  framework for receiving and redistributing abuse feeds and threat intel.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAlienVault Open Threat Exchange[0m[38;5;12m (https://otx.alienvault.com/) - Share and[39m
[38;5;12m  collaborate in developing Threat Intelligence.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCombine[0m[38;5;12m (https://github.com/mlsecproject/combine) - Tool to gather Threat[39m
[38;5;12m  Intelligence indicators from publicly available sources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFileintel[0m[38;5;12m (https://github.com/keithjjones/fileintel) - Pull intelligence per file hash.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHostintel[0m[38;5;12m (https://github.com/keithjjones/hostintel) - Pull intelligence per host.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIntelMQ[0m[38;5;12m (https://www.enisa.europa.eu/topics/csirt-cert-services/community-projects/incident-handling-automation) -[39m
[38;5;12m  A tool for CERTs for processing incident data using a message queue.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIOC Editor[0m[38;5;12m (https://www.fireeye.com/services/freeware/ioc-editor.html) -[39m
[38;5;12m  A free editor for XML IOC files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1miocextract[0m[38;5;12m (https://github.com/InQuest/python-iocextract) - Advanced Indicator[39m
[38;5;12m  of Compromise (IOC) extractor, Python library and command-line tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mioc_writer[0m[38;5;12m (https://github.com/mandiant/ioc_writer) - Python library for[39m
[38;5;12m  working with OpenIOC objects, from Mandiant.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalPipe[0m[38;5;12m (https://github.com/silascutler/MalPipe) - Malware/IOC ingestion and[39m
[38;5;12m  processing engine, that enriches collected data.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMassive Octo Spice[0m[38;5;12m (https://github.com/csirtgadgets/massive-octo-spice) -[39m
[38;5;12m  Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs[39m
[38;5;12m  from various lists. Curated by the[39m
[38;5;12m  [39m[38;5;14m[1mCSIRT Gadgets Foundation[0m[38;5;12m (http://csirtgadgets.org/collective-intelligence-framework).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMISP[0m[38;5;12m (https://github.com/MISP/MISP) - Malware Information Sharing[39m
[38;5;12m  Platform curated by [39m[38;5;14m[1mThe MISP Project[0m[38;5;12m (http://www.misp-project.org/).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPulsedive[0m[38;5;12m (https://pulsedive.com) - Free, community-driven threat intelligence platform collecting IOCs from open-source feeds.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPyIOCe[0m[38;5;12m (https://github.com/pidydx/PyIOCe) - A Python OpenIOC editor.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRiskIQ[0m[38;5;12m (https://community.riskiq.com/) - Research, connect, tag and[39m
[38;5;12m  share IPs and domains. (Was PassiveTotal.)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mthreataggregator[0m[38;5;12m (https://github.com/jpsenior/threataggregator) -[39m
[38;5;12m  Aggregates security threats from a number of sources, including some of[39m
[38;5;12m  those listed below in [39m[38;5;14m[1mother resources[0m[38;5;12m (#other-resources).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatConnect[0m[38;5;12m (https://threatconnect.com/free/) - TC Open allows you to see and[39m
[38;5;12m  share open source threat data, with support and validation from our free community.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatCrowd[0m[38;5;12m (https://www.threatcrowd.org/) - A search engine for threats,[39m
[38;5;12m  with graphical visualization.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatIngestor[0m[38;5;12m (https://github.com/InQuest/ThreatIngestor/) - Build[39m
[38;5;12m  automated threat intel pipelines sourcing from Twitter, RSS, GitHub, and[39m
[38;5;12m  more.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatTracker[0m[38;5;12m (https://github.com/michael-yip/ThreatTracker) - A Python[39m
[38;5;12m  script to monitor and generate alerts based on IOCs indexed by a set of[39m
[38;5;12m  Google Custom Search Engines.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTIQ-test[0m[38;5;12m (https://github.com/mlsecproject/tiq-test) - Data visualization[39m
[38;5;12m  and statistical analysis of Threat Intelligence feeds.[39m

[38;2;255;187;0m[4mOther Resources[0m

[48;2;30;30;40m[38;5;13m[3mThreat intelligence and IOC resources.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAutoshun[0m[38;5;12m (https://www.autoshun.org/) ([39m[38;5;14m[1mlist[0m[38;5;12m (https://www.autoshun.org/files/shunlist.csv)) -[39m
[38;5;12m  Snort plugin and blocklist.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBambenek Consulting Feeds[0m[38;5;12m (http://osint.bambenekconsulting.com/feeds/) -[39m
[38;5;12m  OSINT feeds based on malicious DGA algorithms.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFidelis Barncat[0m[38;5;12m (https://www.fidelissecurity.com/resources/fidelis-barncat) -[39m
[38;5;12m  Extensive malware config database (must request access).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCI Army[0m[38;5;12m (http://cinsscore.com/) ([39m[38;5;14m[1mlist[0m[38;5;12m (http://cinsscore.com/list/ci-badguys.txt)) -[39m
[38;5;12m  Network security blocklists.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCritical Stack- Free Intel Market[0m[38;5;12m (https://intel.criticalstack.com) - Free[39m
[38;5;12m  intel aggregator with deduplication featuring 90+ feeds and over 1.2M indicators.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCybercrime tracker[0m[38;5;12m (http://cybercrime-tracker.net/) - Multiple botnet active tracker.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFireEye IOCs[0m[38;5;12m (https://github.com/fireeye/iocs) - Indicators of Compromise[39m
[38;5;12m  shared publicly by FireEye.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFireHOL IP Lists[0m[38;5;12m (https://iplists.firehol.org/) - Analytics for 350+ IP lists[39m
[38;5;12m  with a focus on attacks, malware and abuse. Evolution, Changes History,[39m
[38;5;12m  Country Maps, Age of IPs listed, Retention Policy, Overlaps.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneyDB[0m[38;5;12m (https://riskdiscovery.com/honeydb) - Community driven honeypot sensor data collection and aggregation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mhpfeeds[0m[38;5;12m (https://github.com/rep/hpfeeds) - Honeypot feed protocol.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInfosec[0m[38;5;14m[1m [0m[38;5;14m[1m-[0m[38;5;14m[1m [0m[38;5;14m[1mCERT-PA[0m[38;5;14m[1m [0m[38;5;14m[1mlists[0m[38;5;12m [39m[38;5;12m(https://infosec.cert-pa.it/analyze/statistics.html)[39m[38;5;12m [39m[38;5;12m([39m[38;5;14m[1mIPs[0m[38;5;12m [39m[38;5;12m(https://infosec.cert-pa.it/analyze/listip.txt)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mDomains[0m[38;5;12m [39m[38;5;12m(https://infosec.cert-pa.it/analyze/listdomains.txt)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;14m[1mURLs[0m[38;5;12m [39m
[38;5;12m(https://infosec.cert-pa.it/analyze/listurls.txt))[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mBlocklist[39m[38;5;12m [39m[38;5;12mservice.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInQuest REPdb[0m[38;5;12m (https://labs.inquest.net/repdb) - Continuous aggregation of IOCs from a variety of open reputation sources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInQuest IOCdb[0m[38;5;12m (https://labs.inquest.net/iocdb) - Continuous aggregation of IOCs from a variety of blogs, Github repos, and Twitter.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInternet Storm Center (DShield)[0m[38;5;12m (https://isc.sans.edu/) - Diary and[39m
[38;5;12m  searchable incident database, with a web [39m[38;5;14m[1mAPI[0m[38;5;12m (https://dshield.org/api/).[39m
[38;5;12m  ([39m[38;5;14m[1munofficial Python library[0m[38;5;12m (https://github.com/rshipp/python-dshield)).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmalc0de[0m[38;5;12m (http://malc0de.com/database/) - Searchable incident database.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Domain List[0m[38;5;12m (http://www.malwaredomainlist.com/) - Search and share[39m
[38;5;12m  malicious URLs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMetaDefender Threat Intelligence Feed[0m[38;5;12m (https://www.opswat.com/developers/threat-intelligence-feed) -[39m
[38;5;12m  List of the most looked up file hashes from MetaDefender Cloud.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOpenIOC[0m[38;5;12m (https://www.fireeye.com/services/freeware.html) - Framework for sharing threat intelligence.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProofpoint Threat Intelligence[0m[38;5;12m (https://www.proofpoint.com/us/products/et-intelligence) -[39m
[38;5;12m  Rulesets and more. (Formerly Emerging Threats.)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRansomware overview[0m[38;5;12m (https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml) -[39m
[38;5;12m  A list of ransomware overview with details, detection and prevention.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSTIX - Structured Threat Information eXpression[0m[38;5;12m (http://stixproject.github.io) -[39m
[38;5;12m  Standardized language to represent and share cyber threat information.[39m
[38;5;12m  Related efforts from [39m[38;5;14m[1mMITRE[0m[38;5;12m (https://www.mitre.org/):[39m
[38;5;12m  - [39m[38;5;14m[1mCAPEC - Common Attack Pattern Enumeration and Classification[0m[38;5;12m (http://capec.mitre.org/)[39m
[38;5;12m  - [39m[38;5;14m[1mCybOX - Cyber Observables eXpression[0m[38;5;12m (http://cyboxproject.github.io)[39m
[38;5;12m  - [39m[38;5;14m[1mMAEC - Malware Attribute Enumeration and Characterization[0m[38;5;12m (http://maec.mitre.org/)[39m
[38;5;12m  - [39m[38;5;14m[1mTAXII - Trusted Automated eXchange of Indicator Information[0m[38;5;12m (http://taxiiproject.github.io)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSystemLookup[0m[38;5;12m (https://www.systemlookup.com/) - SystemLookup hosts a collection of lists that provide information on[39m
[38;5;12m  the components of legitimate and potentially unwanted programs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatMiner[0m[38;5;12m (https://www.threatminer.org/) - Data mining portal for threat[39m
[38;5;12m  intelligence, with search.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mthreatRECON[0m[38;5;12m (https://threatrecon.co/) - Search for indicators, up to 1000[39m
[38;5;12m  free per month.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreatShare[0m[38;5;12m (https://threatshare.io/) - C2 panel tracker[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYara rules[0m[38;5;12m (https://github.com/Yara-Rules/rules) - Yara rules repository.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYETI[0m[38;5;12m (https://github.com/yeti-platform/yeti) - Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZeuS Tracker[0m[38;5;12m (https://zeustracker.abuse.ch/blocklist.php) - ZeuS[39m
[38;5;12m  blocklists.[39m

[38;2;255;187;0m[4mDetection and Classification[0m

[48;2;30;30;40m[38;5;13m[3mAntivirus and other malware identification tools[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAnalyzePE[0m[38;5;12m (https://github.com/hiddenillusion/AnalyzePE) - Wrapper for a[39m
[38;5;12m  variety of tools for reporting on Windows PE files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAssemblyline[0m[38;5;12m (https://cybercentrecanada.github.io/assemblyline4_docs/) - A scalable file triage and malware analysis system integrating the cyber security community's best tools..[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBinaryAlert[0m[38;5;12m (https://github.com/airbnb/binaryalert) - An open source, serverless[39m
[38;5;12m  AWS pipeline that scans and alerts on uploaded files based on a set of[39m
[38;5;12m  YARA rules.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mcapa[0m[38;5;12m (https://github.com/fireeye/capa) - Detects capabilities in executable files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mchkrootkit[0m[38;5;12m (http://www.chkrootkit.org/) - Local Linux rootkit detection.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mClamAV[0m[38;5;12m (http://www.clamav.net/) - Open source antivirus engine.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDetect It Easy(DiE)[0m[38;5;12m (https://github.com/horsicq/Detect-It-Easy) - A program for[39m
[38;5;12m  determining types of files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mExeinfo PE[0m[38;5;12m (http://exeinfo.pe.hu/) - Packer, compressor detector, unpack[39m
[38;5;12m  info, internal exe tools.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mExifTool[0m[38;5;12m (https://sno.phy.queensu.ca/~phil/exiftool/) - Read, write and[39m
[38;5;12m  edit file metadata.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFile Scanning Framework[0m[38;5;12m (https://github.com/EmersonElectricCo/fsf) -[39m
[38;5;12m  Modular, recursive file scanning solution.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mfn2yara[0m[38;5;12m (https://github.com/cmu-sei/pharos) - FN2Yara is a tool to generate[39m
[38;5;12m  Yara signatures for matching functions (code) in an executable program.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mGeneric File Parser[0m[38;5;12m (https://github.com/uppusaikiran/generic-parser) - A Single Library Parser to extract meta information,static analysis and detect macros within the files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mhashdeep[0m[38;5;12m (https://github.com/jessek/hashdeep) - Compute digest hashes with[39m
[38;5;12m  a variety of algorithms.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHashCheck[0m[38;5;12m (https://github.com/gurnec/HashCheck) - Windows shell extension[39m
[38;5;12m  to compute hashes with a variety of algorithms.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mLoki[0m[38;5;12m (https://github.com/Neo23x0/Loki) - Host based scanner for IOCs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalfunction[0m[38;5;12m (https://github.com/Dynetics/Malfunction) - Catalog and[39m
[38;5;12m  compare malware at a function level.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mManalyze[0m[38;5;12m (https://github.com/JusticeRage/Manalyze) - Static analyzer for PE[39m
[38;5;12mexecutables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMASTIFF[0m[38;5;12m (https://github.com/KoreLogicSecurity/mastiff) - Static analysis[39m
[38;5;12m  framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMultiScanner[0m[38;5;12m (https://github.com/mitre/multiscanner) - Modular file[39m
[38;5;12m  scanning/analysis framework[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNauz File Detector(NFD)[0m[38;5;12m (https://github.com/horsicq/Nauz-File-Detector) - Linker/Compiler/Tool detector  for Windows, Linux and MacOS.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mnsrllookup[0m[38;5;12m (https://github.com/rjhansen/nsrllookup) - A tool for looking[39m
[38;5;12m  up hashes in NIST's National Software Reference Library database.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mpackerid[0m[38;5;12m (https://github.com/sooshie/packerid) - A cross-platform[39m
[38;5;12m  Python alternative to PEiD.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPE-bear[0m[38;5;12m (https://hshrzd.wordpress.com/pe-bear/) - Reversing tool for PE[39m
[38;5;12m  files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPEframe[0m[38;5;12m (https://github.com/guelfoweb/peframe) - PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPEV[0m[38;5;12m (http://pev.sourceforge.net/) - A multiplatform toolkit to work with PE[39m
[38;5;12m  files, providing feature-rich tools for proper analysis of suspicious binaries.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPortEx[0m[38;5;12m (https://github.com/katjahahn/PortEx) - Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mQuark-Engine[0m[38;5;12m (https://github.com/quark-engine/quark-engine) - An Obfuscation-Neglect Android Malware Scoring System[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRootkit Hunter[0m[38;5;12m (http://rkhunter.sourceforge.net/) - Detect Linux rootkits.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mssdeep[0m[38;5;12m (https://ssdeep-project.github.io/ssdeep/) - Compute fuzzy hashes.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mtotalhash.py[0m[38;5;12m (https://gist.github.com/gleblanc1783/3c8e6b379fa9d646d401b96ab5c7877f) -[39m
[38;5;12m  Python script for easy searching of the [39m[38;5;14m[1mTotalHash.cymru.com[0m[38;5;12m (https://totalhash.cymru.com/)[39m
[38;5;12m  database.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTrID[0m[38;5;12m (http://mark0.net/soft-trid-e.html) - File identifier.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYARA[0m[38;5;12m (https://plusvic.github.io/yara/) - Pattern matching tool for[39m
[38;5;12m  analysts.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYara rules generator[0m[38;5;12m (https://github.com/Neo23x0/yarGen) - Generate[39m
[38;5;12m  yara rules based on a set of malware samples. Also contains a good[39m
[38;5;12m  strings DB to avoid false positives.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYara Finder[0m[38;5;12m (https://github.com/uppusaikiran/yara-finder) - A simple tool to yara match the file against various yara rules to find the indicators of suspicion.[39m


[38;2;255;187;0m[4mOnline Scanners and Sandboxes[0m

[48;2;30;30;40m[38;5;13m[3mWeb-based multi-AV scanners, and malware sandboxes for automated analysis.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1manlyz.io[0m[38;5;12m (https://sandbox.anlyz.io/) - Online sandbox.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1many.run[0m[38;5;12m (https://app.any.run/) - Online interactive sandbox.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAndroTotal[0m[38;5;12m (https://andrototal.org/) - Free online analysis of APKs[39m
[38;5;12m  against multiple mobile antivirus apps.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBoomBox[0m[38;5;12m (https://github.com/nbeede/BoomBox) - Automatic deployment of Cuckoo[39m
[38;5;12m  Sandbox malware lab using Packer and Vagrant.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCryptam[0m[38;5;12m (http://www.cryptam.com/) - Analyze suspicious office documents.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCuckoo Sandbox[0m[38;5;12m (https://cuckoosandbox.org/) - Open source, self hosted[39m
[38;5;12m  sandbox and automated analysis system.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mcuckoo-modified[0m[38;5;12m (https://github.com/brad-accuvant/cuckoo-modified) - Modified[39m
[38;5;12m  version of Cuckoo Sandbox released under the GPL. Not merged upstream due to[39m
[38;5;12m  legal concerns by the author.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mcuckoo-modified-api[0m[38;5;12m (https://github.com/keithjjones/cuckoo-modified-api) - A[39m
[38;5;12m  Python API used to control a cuckoo-modified sandbox.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDeepViz[0m[38;5;12m (https://www.deepviz.com/) - Multi-format file analyzer with[39m
[38;5;12m  machine-learning classification.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mdetux[0m[38;5;12m (https://github.com/detuxsandbox/detux/) - A sandbox developed to do[39m
[38;5;12m  traffic analysis of Linux malwares and capturing IOCs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDRAKVUF[0m[38;5;12m (https://github.com/tklengyel/drakvuf) - Dynamic malware analysis[39m
[38;5;12m  system.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mfirmware.re[0m[38;5;12m (http://firmware.re/) - Unpacks, scans and analyzes almost any[39m
[38;5;12m  firmware package.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHaboMalHunter[0m[38;5;12m (https://github.com/Tencent/HaboMalHunter) - An Automated Malware[39m
[38;5;12m  Analysis Tool for Linux ELF Files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHybrid Analysis[0m[38;5;12m (https://www.hybrid-analysis.com/) - Online malware[39m
[38;5;12m  analysis tool, powered by VxSandbox.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIntezer[0m[38;5;12m (https://analyze.intezer.com) - Detect, analyze, and categorize malware by[39m
[38;5;12m  identifying code reuse and code similarities.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIRMA[0m[38;5;12m (http://irma.quarkslab.com/) - An asynchronous and customizable[39m
[38;5;12m  analysis platform for suspicious files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJoe Sandbox[0m[38;5;12m (https://www.joesecurity.org) - Deep malware analysis with Joe Sandbox.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJotti[0m[38;5;12m (https://virusscan.jotti.org/en) - Free online multi-AV scanner.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mLimon[0m[38;5;12m (https://github.com/monnappa22/Limon) - Sandbox for Analyzing Linux Malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalheur[0m[38;5;12m (https://github.com/rieck/malheur) - Automatic sandboxed analysis[39m
[38;5;12m  of malware behavior.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmalice.io[0m[38;5;12m (https://github.com/maliceio/malice) - Massively scalable malware analysis framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmalsub[0m[38;5;12m (https://github.com/diogo-fernan/malsub) - A Python RESTful API framework for[39m
[38;5;12m  online malware and URL analysis services.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware config[0m[38;5;12m (https://malwareconfig.com/) - Extract, decode and display online[39m
[38;5;12m  the configuration settings from common malwares.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalwareAnalyser.io[0m[38;5;12m (https://malwareanalyser.io/) - Online malware anomaly-based static analyser with heuristic detection engine powered by data mining and machine learning.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalwr[0m[38;5;12m (https://malwr.com/) - Free analysis with an online Cuckoo Sandbox[39m
[38;5;12m  instance.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMetaDefender Cloud[0m[38;5;12m (https://metadefender.opswat.com/ ) - Scan a file, hash, IP, URL or[39m
[38;5;12m  domain address for malware for free.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNetworkTotal[0m[38;5;12m (https://www.networktotal.com/index.html) - A service that analyzes[39m
[38;5;12m  pcap files and facilitates the quick detection of viruses, worms, trojans, and all[39m
[38;5;12m  kinds of malware using Suricata configured with EmergingThreats Pro.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNoriben[0m[38;5;12m (https://github.com/Rurik/Noriben) - Uses Sysinternals Procmon to[39m
[38;5;12m  collect information about malware in a sandboxed environment.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPacketTotal[0m[38;5;12m (https://packettotal.com/) - PacketTotal is an online engine for analyzing .pcap files, and visualizing the network traffic within.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPDF Examiner[0m[38;5;12m (http://www.pdfexaminer.com/) - Analyse suspicious PDF files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProcDot[0m[38;5;12m (http://www.procdot.com) - A graphical malware analysis tool kit.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRecomposer[0m[38;5;12m (https://github.com/secretsquirrel/recomposer) - A helper[39m
[38;5;12m  script for safely uploading binaries to sandbox sites.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1msandboxapi[0m[38;5;12m (https://github.com/InQuest/python-sandboxapi) - Python library for[39m
[38;5;12m  building integrations with several open source and commercial malware sandboxes.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSEE[0m[38;5;12m (https://github.com/F-Secure/see) - Sandboxed Execution Environment (SEE)[39m
[38;5;12m  is a framework for building test automation in secured Environments.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSEKOIA Dropper Analysis[0m[38;5;12m (https://malware.sekoia.fr/) - Online dropper analysis (Js, VBScript, Microsoft Office, PDF).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVirusTotal[0m[38;5;12m (https://www.virustotal.com/) - Free online analysis of malware[39m
[38;5;12m  samples and URLs[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVisualize_Logs[0m[38;5;12m (https://github.com/keithjjones/visualize_logs) - Open source[39m
[38;5;12m  visualization library and command line tools for logs.  (Cuckoo, Procmon, more[39m
[38;5;12m  to come...)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZeltser's List[0m[38;5;12m (https://zeltser.com/automated-malware-analysis/) - Free[39m
[38;5;12m  automated sandboxes and services, compiled by Lenny Zeltser.[39m

[38;2;255;187;0m[4mDomain Analysis[0m

[48;2;30;30;40m[38;5;13m[3mInspect domains and IP addresses.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAbuseIPDB[0m[38;5;12m (https://www.abuseipdb.com/) - AbuseIPDB is a project dedicated[39m
[38;5;12m  to helping combat the spread of hackers, spammers, and abusive activity on the internet.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mbadips.com[0m[38;5;12m (https://www.badips.com/) - Community based IP blacklist service.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mboomerang[0m[38;5;12m (https://github.com/EmersonElectricCo/boomerang) - A tool designed[39m
[38;5;12m  for consistent and safe capture of off network web resources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCymon[0m[38;5;12m (https://cymon.io/) - Threat intelligence tracker, with IP/domain/hash[39m
[38;5;12m  search.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDesenmascara.me[0m[38;5;12m (http://desenmascara.me) - One click tool to retrieve as[39m
[38;5;12m  much metadata as possible for a website and to assess its good standing.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDig[0m[38;5;12m (https://networking.ringofsaturn.com/) - Free online dig and other[39m
[38;5;12m  network tools.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mdnstwist[0m[38;5;12m (https://github.com/elceef/dnstwist) - Domain name permutation[39m
[38;5;12m  engine for detecting typo squatting, phishing and corporate espionage.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIPinfo[0m[38;5;12m (https://github.com/hiddenillusion/IPinfo) - Gather information[39m
[38;5;12m  about an IP or domain by searching online resources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMachinae[0m[38;5;12m (https://github.com/hurricanelabs/machinae) - OSINT tool for[39m
[38;5;12m  gathering information about URLs, IPs, or hashes. Similar to Automator.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmailchecker[0m[38;5;12m (https://github.com/FGRibreau/mailchecker) - Cross-language[39m
[38;5;12m  temporary email detection library.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMaltegoVT[0m[38;5;12m (https://github.com/michael-yip/MaltegoVT) - Maltego transform[39m
[38;5;12m  for the VirusTotal API. Allows domain/IP research, and searching for file[39m
[38;5;12m  hashes and scan reports.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMulti rbl[0m[38;5;12m (http://multirbl.valli.org/) - Multiple DNS blacklist and forward[39m
[38;5;12m  confirmed reverse DNS lookup over more than 300 RBLs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNormShield Services[0m[38;5;12m (https://services.normshield.com/) - Free API Services[39m
[38;5;12m  for detecting possible phishing domains, blacklisted ip addresses and breached[39m
[38;5;12m  accounts.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPhishStats[0m[38;5;12m (https://phishstats.info/) - Phishing Statistics with search for[39m
[38;5;12m  IP, domain and website title[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSpyse[0m[38;5;12m (https://spyse.com/) - subdomains, whois, realted domains, DNS, hosts AS, SSL/TLS info,[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSecurityTrails[0m[38;5;12m (https://securitytrails.com/) - Historical and current WHOIS,[39m
[38;5;12m  historical and current DNS records, similar domains, certificate information[39m
[38;5;12m  and other domain and IP related API and tools.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSpamCop[0m[38;5;12m (https://www.spamcop.net/bl.shtml) - IP based spam block list.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSpamHaus[0m[38;5;12m (https://www.spamhaus.org/lookup/) - Block list based on[39m
[38;5;12m  domains and IPs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSucuri SiteCheck[0m[38;5;12m (https://sitecheck.sucuri.net/) - Free Website Malware[39m
[38;5;12m  and Security Scanner.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTalos Intelligence[0m[38;5;12m (https://talosintelligence.com/) - Search for IP, domain[39m
[38;5;12m  or network owner. (Previously SenderBase.)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTekDefense Automater[0m[38;5;12m (http://www.tekdefense.com/automater/) - OSINT tool[39m
[38;5;12m  for gathering information about URLs, IPs, or hashes.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mURLhaus[0m[38;5;12m (https://urlhaus.abuse.ch/) - A project from abuse.ch with the goal[39m
[38;5;12m  of sharing malicious URLs that are being used for malware distribution.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mURLQuery[0m[38;5;12m (http://urlquery.net/) - Free URL Scanner.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1murlscan.io[0m[38;5;12m (https://urlscan.io/) - Free URL Scanner & domain information.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWhois[0m[38;5;12m (https://whois.domaintools.com/) - DomainTools free online whois[39m
[38;5;12m  search.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZeltser's List[0m[38;5;12m (https://zeltser.com/lookup-malicious-websites/) - Free[39m
[38;5;12m  online tools for researching malicious websites, compiled by Lenny Zeltser.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mZScalar Zulu[0m[38;5;12m (https://zulu.zscaler.com/#) - Zulu URL Risk Analyzer.[39m

[38;2;255;187;0m[4mBrowser Malware[0m

[48;2;30;30;40m[38;5;13m[3mAnalyze malicious URLs. See also the [0m[48;2;30;30;40m[38;5;14m[1m[3mdomain analysis[0m[48;2;30;30;40m[38;5;13m[3m (#domain-analysis) and[0m
[38;5;14m[1mdocuments and shellcode[0m[38;5;12m (#documents-and-shellcode) sections.*[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBytecode Viewer[0m[38;5;12m (https://github.com/Konloch/bytecode-viewer) - Combines[39m
[38;5;12m  multiple Java bytecode viewers and decompilers into one tool, including[39m
[38;5;12m  APK/DEX support.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFirebug[0m[38;5;12m (https://getfirebug.com/) - Firefox extension for web development.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJava Decompiler[0m[38;5;12m (http://jd.benow.ca/) - Decompile and inspect Java apps.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJava IDX Parser[0m[38;5;12m (https://github.com/Rurik/Java_IDX_Parser/) - Parses Java[39m
[38;5;12m  IDX cache files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJSDetox[0m[38;5;12m (http://www.relentless-coding.com/projects/jsdetox/) - JavaScript[39m
[38;5;12m  malware analysis tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mjsunpack-n[0m[38;5;12m (https://github.com/urule99/jsunpack-n) - A javascript[39m
[38;5;12m  unpacker that emulates browser functionality.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mKrakatau[0m[38;5;12m (https://github.com/Storyyeller/Krakatau) - Java decompiler,[39m
[38;5;12m  assembler, and disassembler.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalzilla[0m[38;5;12m (http://malzilla.sourceforge.net/) - Analyze malicious web pages.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRABCDAsm[0m[38;5;12m (https://github.com/CyberShadow/RABCDAsm) - A "Robust[39m
[38;5;12m  ActionScript Bytecode Disassembler."[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSWF Investigator[0m[38;5;12m (https://labs.adobe.com/technologies/swfinvestigator/) -[39m
[38;5;12m  Static and dynamic analysis of SWF applications.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mswftools[0m[38;5;12m (http://www.swftools.org/) - Tools for working with Adobe Flash[39m
[38;5;12m  files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mxxxswf[0m[38;5;12m (http://hooked-on-mnemonics.blogspot.com/2011/12/xxxswfpy.html) - A[39m
[38;5;12m  Python script for analyzing Flash files.[39m

[38;2;255;187;0m[4mDocuments and Shellcode[0m

[48;2;30;30;40m[38;5;13m[3mAnalyze malicious JS and shellcode from PDFs and Office documents. See also[0m
[38;5;12mthe [39m[38;5;14m[1mbrowser malware[0m[38;5;12m (#browser-malware) section.*[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAnalyzePDF[0m[38;5;12m (https://github.com/hiddenillusion/AnalyzePDF) - A tool for[39m
[38;5;12m  analyzing PDFs and attempting to determine whether they are malicious.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mbox-js[0m[38;5;12m (https://github.com/CapacitorSet/box-js) - A tool for studying JavaScript[39m
[38;5;12m  malware, featuring JScript/WScript support and ActiveX emulation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mdiStorm[0m[38;5;12m (http://www.ragestorm.net/distorm/) - Disassembler for analyzing[39m
[38;5;12m  malicious shellcode.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInQuest Deep File Inspection[0m[38;5;12m (https://labs.inquest.net/dfi) - Upload common malware lures for Deep File Inspection and heuristical analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mJS Beautifier[0m[38;5;12m (http://jsbeautifier.org/) - JavaScript unpacking and deobfuscation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mlibemu[0m[38;5;12m (http://libemu.carnivore.it/) - Library and tools for x86 shellcode[39m
[38;5;12m  emulation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmalpdfobj[0m[38;5;12m (https://github.com/9b/malpdfobj) - Deconstruct malicious PDFs[39m
[38;5;12m  into a JSON representation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOfficeMalScanner[0m[38;5;12m (http://www.reconstructer.org/code.html) - Scan for[39m
[38;5;12m  malicious traces in MS Office documents.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1molevba[0m[38;5;12m (http://www.decalage.info/python/olevba) - A script for parsing OLE[39m
[38;5;12m  and OpenXML documents and extracting useful information.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOrigami PDF[0m[38;5;12m (https://code.google.com/archive/p/origami-pdf) - A tool for[39m
[38;5;12m  analyzing malicious PDFs, and more.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPDF Tools[0m[38;5;12m (https://blog.didierstevens.com/programs/pdf-tools/) - pdfid,[39m
[38;5;12m  pdf-parser, and more from Didier Stevens.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPDF X-Ray Lite[0m[38;5;12m (https://github.com/9b/pdfxray_lite) - A PDF analysis tool,[39m
[38;5;12m  the backend-free version of PDF X-RAY.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mpeepdf[0m[38;5;12m (http://eternal-todo.com/tools/peepdf-pdf-analysis-tool) - Python[39m
[38;5;12m  tool for exploring possibly malicious PDFs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mQuickSand[0m[38;5;12m (https://www.quicksand.io/) - QuickSand is a compact C framework[39m
[38;5;12m  to analyze suspected malware documents to identify exploits in streams of different[39m
[38;5;12m  encodings and to locate and extract embedded executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSpidermonkey[0m[38;5;12m (https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey) -[39m
[38;5;12m  Mozilla's JavaScript engine, for debugging malicious JS.[39m

[38;2;255;187;0m[4mFile Carving[0m

[48;2;30;30;40m[38;5;13m[3mFor extracting files from inside disk and memory images.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mbulk_extractor[0m[38;5;12m (https://github.com/simsong/bulk_extractor) - Fast file[39m
[38;5;12m  carving tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mEVTXtract[0m[38;5;12m (https://github.com/williballenthin/EVTXtract) - Carve Windows[39m
[38;5;12m  Event Log files from raw binary data.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mForemost[0m[38;5;12m (http://foremost.sourceforge.net/) - File carving tool designed[39m
[38;5;12m  by the US Air Force.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mhachoir3[0m[38;5;12m (https://github.com/vstinner/hachoir3) - Hachoir is a Python library[39m
[38;5;12m  to view and edit a binary stream field by field.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mScalpel[0m[38;5;12m (https://github.com/sleuthkit/scalpel) - Another data carving[39m
[38;5;12m  tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSFlock[0m[38;5;12m (https://github.com/jbremer/sflock) - Nested archive[39m
[38;5;12m  extraction/unpacking (used in Cuckoo Sandbox).[39m

[38;2;255;187;0m[4mDeobfuscation[0m

[48;2;30;30;40m[38;5;13m[3mReverse XOR and other code obfuscation methods.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBalbuzard[0m[38;5;12m (https://bitbucket.org/decalage/balbuzard/wiki/Home) - A malware[39m
[38;5;12m  analysis tool for reversing obfuscation (XOR, ROL, etc) and more.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mde4dot[0m[38;5;12m (https://github.com/0xd4d/de4dot) - .NET deobfuscator and[39m
[38;5;12m  unpacker.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mex_pe_xor[0m[38;5;12m (http://hooked-on-mnemonics.blogspot.com/2014/04/expexorpy.html)[39m
[38;5;12m  & [39m[38;5;14m[1miheartxor[0m[38;5;12m (http://hooked-on-mnemonics.blogspot.com/p/iheartxor.html) -[39m
[38;5;12m  Two tools from Alexander Hanel for working with single-byte XOR encoded[39m
[38;5;12m  files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFLOSS[0m[38;5;12m (https://github.com/fireeye/flare-floss) - The FireEye Labs Obfuscated[39m
[38;5;12m  String Solver uses advanced static analysis techniques to automatically[39m
[38;5;12m  deobfuscate strings from malware binaries.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNoMoreXOR[0m[38;5;12m (https://github.com/hiddenillusion/NoMoreXOR) - Guess a 256 byte[39m
[38;5;12m  XOR key using frequency analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPackerAttacker[0m[38;5;12m (https://github.com/BromiumLabs/PackerAttacker) - A generic[39m
[38;5;12m  hidden code extractor for Windows malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPyInstaller Extractor[0m[38;5;12m (https://github.com/extremecoders-re/pyinstxtractor) -[39m
[38;5;12m  A Python script to extract the contents of a PyInstaller generated Windows[39m
[38;5;12m  executable file. The contents of the pyz file (usually pyc files) present[39m
[38;5;12m  inside the executable are also extracted and automatically fixed so that a[39m
[38;5;12m  Python bytecode decompiler will recognize it.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1muncompyle6[0m[38;5;12m (https://github.com/rocky/python-uncompyle6/) - A cross-version[39m
[38;5;12m  Python bytecode decompiler.  Translates Python bytecode back into equivalent[39m
[38;5;12m  Python source code.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mun{i}packer[0m[38;5;12m (https://github.com/unipacker/unipacker) - Automatic and[39m
[38;5;12m  platform-independent unpacker for Windows binaries based on emulation.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1munpacker[0m[38;5;12m (https://github.com/malwaremusings/unpacker/) - Automated malware[39m
[38;5;12m  unpacker for Windows malware based on WinAppDbg.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1munxor[0m[38;5;12m (https://github.com/tomchop/unxor/) - Guess XOR keys using[39m
[38;5;12m  known-plaintext attacks.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVirtualDeobfuscator[0m[38;5;12m (https://github.com/jnraber/VirtualDeobfuscator) -[39m
[38;5;12m  Reverse engineering tool for virtualization wrappers.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mXORBruteForcer[0m[38;5;12m (http://eternal-todo.com/var/scripts/xorbruteforcer) -[39m
[38;5;12m  A Python script for brute forcing single-byte XOR keys.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mXORSearch & XORStrings[0m[38;5;12m (https://blog.didierstevens.com/programs/xorsearch/) -[39m
[38;5;12m  A couple programs from Didier Stevens for finding XORed data.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mxortool[0m[38;5;12m (https://github.com/hellman/xortool) - Guess XOR key length, as[39m
[38;5;12m  well as the key itself.[39m

[38;2;255;187;0m[4mDebugging and Reverse Engineering[0m

[48;2;30;30;40m[38;5;13m[3mDisassemblers, debuggers, and other static and dynamic analysis tools.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mangr[0m[38;5;12m (https://github.com/angr/angr) - Platform-agnostic binary analysis[39m
[38;5;12m  framework developed at UCSB's Seclab.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mbamfdetect[0m[38;5;12m (https://github.com/bwall/bamfdetect) - Identifies and extracts[39m
[38;5;12m  information from bots and other malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBAP[0m[38;5;12m (https://github.com/BinaryAnalysisPlatform/bap) - Multiplatform and[39m
[38;5;12m  open source (MIT) binary analysis framework developed at CMU's Cylab.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBARF[0m[38;5;12m (https://github.com/programa-stic/barf-project) - Multiplatform, open[39m
[38;5;12m  source Binary Analysis and Reverse engineering Framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mbinnavi[0m[38;5;12m (https://github.com/google/binnavi) - Binary analysis IDE for[39m
[38;5;12m  reverse engineering based on graph visualization.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBinary ninja[0m[38;5;12m (https://binary.ninja/) - A reversing engineering platform[39m
[38;5;12m  that is an alternative to IDA.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBinwalk[0m[38;5;12m (https://github.com/devttys0/binwalk) - Firmware analysis tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBluePill[0m[38;5;12m (https://github.com/season-lab/bluepill) - Framework for executing and debugging evasive malware and protected executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCapstone[0m[38;5;12m (https://github.com/aquynh/capstone) - Disassembly framework for[39m
[38;5;12m  binary analysis and reversing, with support for many architectures and[39m
[38;5;12m  bindings in several languages.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mcodebro[0m[38;5;12m (https://github.com/hugsy/codebro) - Web based code browser using[39m
[38;5;12m  clang to provide basic code analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCutter[0m[38;5;12m (https://github.com/radareorg/cutter) - GUI for Radare2.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDECAF (Dynamic Executable Code Analysis Framework)[0m[38;5;12m (https://github.com/sycurelab/DECAF)[39m
[38;5;12m  - A binary analysis platform based   on QEMU. DroidScope is now an extension to DECAF.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mdnSpy[0m[38;5;12m (https://github.com/0xd4d/dnSpy) - .NET assembly editor, decompiler[39m
[38;5;12m  and debugger.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mdotPeek[0m[38;5;12m (https://www.jetbrains.com/decompiler/) - Free .NET Decompiler and[39m
[38;5;12m  Assembly Browser.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mEvan's Debugger (EDB)[0m[38;5;12m (http://codef00.com/projects#debugger) - A[39m
[38;5;12m  modular debugger with a Qt GUI.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFibratus[0m[38;5;12m (https://github.com/rabbitstack/fibratus) - Tool for exploration[39m
[38;5;12m  and tracing of the Windows kernel.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFPort[0m[38;5;12m (https://www.mcafee.com/us/downloads/free-tools/fport.aspx) - Reports[39m
[38;5;12m  open TCP/IP and UDP ports in a live system and maps them to the owning application.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mGDB[0m[38;5;12m (http://www.sourceware.org/gdb/) - The GNU debugger.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mGEF[0m[38;5;12m (https://github.com/hugsy/gef) - GDB Enhanced Features, for exploiters[39m
[38;5;12m  and reverse engineers.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mGhidra[0m[38;5;12m (https://github.com/NationalSecurityAgency/ghidra) - A software reverse engineering (SRE) framework created and       maintained by the National Security Agency Research Directorate.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mhackers-grep[0m[38;5;12m (https://github.com/codypierce/hackers-grep) - A utility to[39m
[38;5;12m  search for strings in PE executables including imports, exports, and debug[39m
[38;5;12m  symbols.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHopper[0m[38;5;12m (https://www.hopperapp.com/) - The macOS and Linux Disassembler.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIDA Pro[0m[38;5;12m (https://www.hex-rays.com/products/ida/index.shtml) - Windows[39m
[38;5;12m  disassembler and debugger, with a free evaluation version.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIDR[0m[38;5;12m (https://github.com/crypto2011/IDR) - Interactive Delphi Reconstructor[39m
[38;5;12m  is a decompiler of Delphi executable files and dynamic libraries.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mImmunity Debugger[0m[38;5;12m (http://debugger.immunityinc.com/) - Debugger for[39m
[38;5;12m  malware analysis and more, with a Python API.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mILSpy[0m[38;5;12m (http://ilspy.net/) - ILSpy is the open-source .NET assembly browser and decompiler.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mKaitai Struct[0m[38;5;12m (http://kaitai.io/) - DSL for file formats / network protocols /[39m
[38;5;12m  data structures reverse engineering and dissection, with code generation[39m
[38;5;12m  for C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mLIEF[0m[38;5;12m (https://lief.quarkslab.com/) - LIEF provides a cross-platform library[39m
[38;5;12m  to parse, modify and abstract ELF, PE and MachO formats.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mltrace[0m[38;5;12m (http://ltrace.org/) - Dynamic analysis for Linux executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmac-a-mal[0m[38;5;12m (https://github.com/phdphuc/mac-a-mal) - An automated framework[39m
[38;5;12m  for mac malware hunting.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mobjdump[0m[38;5;12m (https://en.wikipedia.org/wiki/Objdump) - Part of GNU binutils,[39m
[38;5;12m  for static analysis of Linux binaries.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOllyDbg[0m[38;5;12m (http://www.ollydbg.de/) - An assembly-level debugger for Windows[39m
[38;5;12m  executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mOllyDumpEx[0m[38;5;12m (https://low-priority.appspot.com/ollydumpex/) - Dump memory[39m
[38;5;12m  from (unpacked) malware Windows process and store raw or rebuild PE file.[39m
[38;5;12m  This is a plugin for OllyDbg, Immunity Debugger, IDA Pro, WinDbg, and x64dbg.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPANDA[0m[38;5;12m (https://github.com/moyix/panda) - Platform for Architecture-Neutral[39m
[38;5;12m  Dynamic Analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPEDA[0m[38;5;12m (https://github.com/longld/peda) - Python Exploit Development[39m
[38;5;12m  Assistance for GDB, an enhanced display with added commands.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mpestudio[0m[38;5;12m (https://winitor.com/) - Perform static analysis of Windows[39m
[38;5;12m  executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPharos[0m[38;5;12m (https://github.com/cmu-sei/pharos) - The Pharos binary analysis framework[39m
[38;5;12m  can be used to perform automated static analysis of binaries.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mplasma[0m[38;5;12m (https://github.com/plasma-disassembler/plasma) - Interactive[39m
[38;5;12m  disassembler for x86/ARM/MIPS.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPPEE (puppy)[0m[38;5;12m (https://www.mzrst.com/) - A Professional PE file Explorer for[39m
[38;5;12m  reversers, malware researchers and those who want to statically inspect PE[39m
[38;5;12m  files in more detail.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProcess Explorer[0m[38;5;12m (https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer) -[39m
[38;5;12m  Advanced task manager for Windows.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProcess Hacker[0m[38;5;12m (http://processhacker.sourceforge.net/) - Tool that monitors[39m
[38;5;12m  system resources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mProcess Monitor[0m[38;5;12m (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) -[39m
[38;5;12m  Advanced monitoring tool for Windows programs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPSTools[0m[38;5;12m (https://docs.microsoft.com/en-us/sysinternals/downloads/pstools) - Windows[39m
[38;5;12m  command-line tools that help manage and investigate live systems.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPyew[0m[38;5;12m (https://github.com/joxeankoret/pyew) - Python tool for malware[39m
[38;5;12m  analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPyREBox[0m[38;5;12m (https://github.com/Cisco-Talos/pyrebox) - Python scriptable reverse[39m
[38;5;12m  engineering sandbox by the Talos team at Cisco.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mQiling Framework[0m[38;5;12m (https://www.qiling.io/) - Cross platform emulation and sanboxing[39m
[38;5;12m  framework with instruments for binary analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mQKD[0m[38;5;12m (https://github.com/ispras/qemu/releases/) - QEMU with embedded WinDbg[39m
[38;5;12m  server for stealth debugging.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRadare2[0m[38;5;12m (http://www.radare.org/r/) - Reverse engineering framework, with[39m
[38;5;12m  debugger support.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRegShot[0m[38;5;12m (https://sourceforge.net/projects/regshot/) - Registry compare utility[39m
[38;5;12m  that compares snapshots.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRetDec[0m[38;5;12m (https://retdec.com/) - Retargetable machine-code decompiler with an[39m
[38;5;12m  [39m[38;5;14m[1monline decompilation service[0m[38;5;12m (https://retdec.com/decompilation/) and[39m
[38;5;12m  [39m[38;5;14m[1mAPI[0m[38;5;12m (https://retdec.com/api/) that you can use in your tools.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mROPMEMU[0m[38;5;12m (https://github.com/Cisco-Talos/ROPMEMU) - A framework to analyze, dissect[39m
[38;5;12m  and decompile complex code-reuse attacks.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mScylla Imports Reconstructor[0m[38;5;12m (https://github.com/NtQuery/Scylla) - Find and fix[39m
[38;5;12m  the IAT of an unpacked / dumped PE32 malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mScyllaHide[0m[38;5;12m (https://github.com/x64dbg/ScyllaHide) - An Anti-Anti-Debug library[39m
[38;5;12m  and plugin for OllyDbg, x64dbg, IDA Pro, and TitanEngine.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSMRT[0m[38;5;12m (https://github.com/pidydx/SMRT) - Sublime Malware Research Tool, a[39m
[38;5;12m  plugin for Sublime 3 to aid with malware analyis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mstrace[0m[38;5;12m (https://sourceforge.net/projects/strace/) - Dynamic analysis for[39m
[38;5;12m  Linux executables.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mStringSifter[0m[38;5;12m (https://github.com/fireeye/stringsifter) - A machine learning tool[39m
[38;5;12m  that automatically ranks strings based on their relevance for malware analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTriton[0m[38;5;12m (https://triton.quarkslab.com/) - A dynamic binary analysis (DBA) framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mUdis86[0m[38;5;12m (https://github.com/vmt/udis86) - Disassembler library and tool[39m
[38;5;12m  for x86 and x86_64.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVivisect[0m[38;5;12m (https://github.com/vivisect/vivisect) - Python tool for[39m
[38;5;12m  malware analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWinDbg[0m[38;5;12m [39m[38;5;12m(https://developer.microsoft.com/en-us/windows/hardware/download-windbg)[39m[38;5;12m [39m[38;5;12m-[39m[38;5;12m [39m[38;5;12mmultipurpose[39m[38;5;12m [39m[38;5;12mdebugger[39m[38;5;12m [39m[38;5;12mfor[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mMicrosoft[39m[38;5;12m [39m[38;5;12mWindows[39m[38;5;12m [39m[38;5;12mcomputer[39m[38;5;12m [39m[38;5;12moperating[39m[38;5;12m [39m[38;5;12msystem,[39m[38;5;12m [39m[38;5;12mused[39m[38;5;12m [39m[38;5;12mto[39m[38;5;12m [39m[38;5;12mdebug[39m[38;5;12m [39m[38;5;12muser[39m[38;5;12m [39m[38;5;12mmode[39m[38;5;12m [39m[38;5;12mapplications,[39m[38;5;12m [39m[38;5;12mdevice[39m[38;5;12m [39m[38;5;12mdrivers,[39m[38;5;12m [39m[38;5;12mand[39m[38;5;12m [39m[38;5;12mthe[39m[38;5;12m [39m[38;5;12mkernel-mode[39m[38;5;12m [39m
[38;5;12mmemory[39m[38;5;12m [39m[38;5;12mdumps.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mX64dbg[0m[38;5;12m (https://github.com/x64dbg/) - An open-source x64/x32 debugger for windows.[39m

[38;2;255;187;0m[4mNetwork[0m

[48;2;30;30;40m[38;5;13m[3mAnalyze network interactions.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBro[0m[38;5;12m (https://www.bro.org) - Protocol analyzer that operates at incredible[39m
[38;5;12m  scale; both file and network protocols.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBroYara[0m[38;5;12m (https://github.com/hempnall/broyara) - Use Yara rules from Bro.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCapTipper[0m[38;5;12m (https://github.com/omriher/CapTipper) -  Malicious HTTP traffic[39m
[38;5;12m  explorer.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mchopshop[0m[38;5;12m (https://github.com/MITRECND/chopshop) - Protocol analysis and[39m
[38;5;12m  decoding framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCloudShark[0m[38;5;12m (https://www.cloudshark.org) - Web-based tool for packet analysis[39m
[38;5;12m  and malware traffic detection.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFakeNet-NG[0m[38;5;12m (https://github.com/fireeye/flare-fakenet-ng) - Next generation[39m
[38;5;12m  dynamic network analysis tool.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFiddler[0m[38;5;12m (https://www.telerik.com/fiddler) - Intercepting web proxy designed[39m
[38;5;12m  for "web debugging."[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHale[0m[38;5;12m (https://github.com/pjlantz/Hale) - Botnet C&C monitor.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHaka[0m[38;5;12m (http://www.haka-security.org/) - An open source security oriented[39m
[38;5;12m  language for describing protocols and applying security policies on (live)[39m
[38;5;12m  captured traffic.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHTTPReplay[0m[38;5;12m (https://github.com/jbremer/httpreplay) - Library for parsing[39m
[38;5;12m  and reading out PCAP files, including TLS streams using TLS Master Secrets[39m
[38;5;12m  (used in Cuckoo Sandbox).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mINetSim[0m[38;5;12m (http://www.inetsim.org/) - Network service emulation, useful when[39m
[38;5;12m  building a malware lab.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mLaika BOSS[0m[38;5;12m (https://github.com/lmco/laikaboss) - Laika BOSS is a file-centric[39m
[38;5;12m  malware analysis and intrusion detection system.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalcolm[0m[38;5;12m (https://github.com/idaholab/Malcolm) - Malcolm is a powerful, easily[39m
[38;5;12m  deployable network traffic analysis tool suite for full packet capture artifacts[39m
[38;5;12m  (PCAP files) and Zeek logs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalcom[0m[38;5;12m (https://github.com/tomchop/malcom) - Malware Communications[39m
[38;5;12m  Analyzer.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMaltrail[0m[38;5;12m (https://github.com/stamparm/maltrail) - A malicious traffic[39m
[38;5;12m  detection system, utilizing publicly available (black)lists containing[39m
[38;5;12m  malicious and/or generally suspicious trails and featuring an reporting[39m
[38;5;12m  and analysis interface.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mmitmproxy[0m[38;5;12m (https://mitmproxy.org/) - Intercept network traffic on the fly.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMoloch[0m[38;5;12m (https://github.com/aol/moloch) - IPv4 traffic capturing, indexing[39m
[38;5;12m  and database system.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mNetworkMiner[0m[38;5;12m (http://www.netresec.com/?page=NetworkMiner) - Network[39m
[38;5;12m  forensic analysis tool, with a free version.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mngrep[0m[38;5;12m (https://github.com/jpr5/ngrep) - Search through network traffic[39m
[38;5;12m  like grep.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPcapViz[0m[38;5;12m (https://github.com/mateuszk87/PcapViz) - Network topology and[39m
[38;5;12m  traffic visualizer.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPython ICAP Yara[0m[38;5;12m (https://github.com/RamadhanAmizudin/python-icap-yara) - An[39m
[38;5;12m  ICAP Server with yara scanner for URL or content.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSquidmagic[0m[38;5;12m (https://github.com/ch3k1/squidmagic) - squidmagic is a tool[39m
[38;5;12m  designed to analyze a web-based network traffic to detect central command[39m
[38;5;12m  and control (C&C) servers and malicious sites, using Squid proxy server and[39m
[38;5;12m  Spamhaus.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTcpdump[0m[38;5;12m (http://www.tcpdump.org/) - Collect network traffic.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mtcpick[0m[38;5;12m (http://tcpick.sourceforge.net/) - Trach and reassemble TCP streams[39m
[38;5;12m  from network traffic.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mtcpxtract[0m[38;5;12m (http://tcpxtract.sourceforge.net/) - Extract files from network[39m
[38;5;12m  traffic.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWireshark[0m[38;5;12m (https://www.wireshark.org/) - The network traffic analysis[39m
[38;5;12m  tool.[39m

[38;2;255;187;0m[4mMemory Forensics[0m

[48;2;30;30;40m[38;5;13m[3mTools for dissecting malware in memory images or running systems.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mBlackLight[0m[38;5;12m (https://www.blackbagtech.com/blacklight.html) - Windows/MacOS[39m
[38;5;12m  forensics client supporting hiberfil, pagefile, raw memory analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDAMM[0m[38;5;12m (https://github.com/504ensicsLabs/DAMM) - Differential Analysis of[39m
[38;5;12m  Malware in Memory, built on Volatility.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mevolve[0m[38;5;12m (https://github.com/JamesHabben/evolve) - Web interface for the[39m
[38;5;12m  Volatility Memory Forensics Framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFindAES[0m[38;5;12m (https://sourceforge.net/projects/findaes/) - Find AES[39m
[38;5;12m  encryption keys in memory.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1minVtero.net[0m[38;5;12m (https://github.com/ShaneK2/inVtero.net) - High speed memory[39m
[38;5;12m  analysis framework developed in .NET supports all Windows x64, includes[39m
[38;5;12m  code integrity and write support.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMuninn[0m[38;5;12m (https://github.com/ytisf/muninn) - A script to automate portions[39m
[38;5;12m  of analysis using Volatility, and create a readable report.[39m
[38;5;12m  [39m[38;5;14m[1mOrochi[0m[38;5;12m (https://github.com/LDO-CERT/orochi) - Orochi is an open source framework for [39m
[38;5;12m  collaborative forensic memory dump analysis. [39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRekall[0m[38;5;12m (http://www.rekall-forensic.com/) - Memory analysis framework,[39m
[38;5;12m  forked from Volatility in 2013.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTotalRecall[0m[38;5;12m (https://github.com/sketchymoose/TotalRecall) - Script based[39m
[38;5;12m  on Volatility for automating various malware analysis tasks.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVolDiff[0m[38;5;12m (https://github.com/aim4r/VolDiff) - Run Volatility on memory[39m
[38;5;12m  images before and after malware execution, and report changes.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVolatility[0m[38;5;12m (https://github.com/volatilityfoundation/volatility) - Advanced[39m
[38;5;12m  memory forensics framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mVolUtility[0m[38;5;12m (https://github.com/kevthehermit/VolUtility) - Web Interface for[39m
[38;5;12m  Volatility Memory Analysis framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWDBGARK[0m[38;5;12m (https://github.com/swwwolf/wdbgark) -[39m
[38;5;12m  WinDBG Anti-RootKit Extension.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWinDbg[0m[38;5;12m (https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit) -[39m
[38;5;12m  Live memory inspection and kernel debugging for Windows systems.[39m

[38;2;255;187;0m[4mWindows Artifacts[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAChoir[0m[38;5;12m (https://github.com/OMENScan/AChoir) - A live incident response[39m
[38;5;12m  script for gathering Windows artifacts.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mpython-evt[0m[38;5;12m (https://github.com/williballenthin/python-evt) - Python[39m
[38;5;12m  library for parsing Windows Event Logs.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mpython-registry[0m[38;5;12m (http://www.williballenthin.com/registry/) - Python[39m
[38;5;12m  library for parsing registry files.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRegRipper[0m[38;5;12m (http://brettshavers.cc/index.php/brettsblog/tags/tag/regripper/)[39m
[38;5;12m  ([39m[38;5;14m[1mGitHub[0m[38;5;12m (https://github.com/keydet89/RegRipper2.8)) -[39m
[38;5;12m  Plugin-based registry analysis tool.[39m

[38;2;255;187;0m[4mStorage and Workflow[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAleph[0m[38;5;12m (https://github.com/merces/aleph) - Open Source Malware Analysis[39m
[38;5;12m  Pipeline System.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCRITs[0m[38;5;12m (https://crits.github.io/) - Collaborative Research Into Threats, a[39m
[38;5;12m  malware and threat repository.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFAME[0m[38;5;12m (https://certsocietegenerale.github.io/fame/) - A malware analysis[39m
[38;5;12m  framework featuring a pipeline that can be extended with custom modules,[39m
[38;5;12m  which can be chained and interact with each other to perform end-to-end[39m
[38;5;12m  analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalwarehouse[0m[38;5;12m (https://github.com/sroberts/malwarehouse) - Store, tag, and[39m
[38;5;12m  search malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPolichombr[0m[38;5;12m (https://github.com/ANSSI-FR/polichombr) - A malware analysis[39m
[38;5;12m  platform designed to help analysts to reverse malwares collaboratively.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mstoQ[0m[38;5;12m (http://stoq.punchcyber.com) - Distributed content analysis[39m
[38;5;12m  framework with extensive plugin support, from input to output, and everything[39m
[38;5;12m  in between.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mViper[0m[38;5;12m (http://viper.li/) - A binary management and analysis framework for[39m
[38;5;12m  analysts and researchers.[39m

[38;2;255;187;0m[4mMiscellaneous[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mal-khaser[0m[38;5;12m (https://github.com/LordNoteworthy/al-khaser) - A PoC malware[39m
[38;5;12m  with good intentions that aimes to stress anti-malware systems.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCryptoKnight[0m[38;5;12m (https://github.com/AbertayMachineLearningGroup/CryptoKnight) - Automated cryptographic algorithm reverse engineering and classification framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mDC3-MWCP[0m[38;5;12m (https://github.com/Defense-Cyber-Crime-Center/DC3-MWCP) -[39m
[38;5;12m  The Defense Cyber Crime Center's Malware Configuration Parser framework.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFLARE VM[0m[38;5;12m (https://github.com/fireeye/flare-vm) - A fully customizable,[39m
[38;5;12m  Windows-based, security distribution for malware analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalSploitBase[0m[38;5;12m (https://github.com/misterch0c/malSploitBase) - A database[39m
[38;5;12m  containing exploits used by malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Museum[0m[38;5;12m (https://archive.org/details/malwaremuseum) - Collection of[39m
[38;5;12m  malware programs that were distributed in the 1980s and 1990s.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Organiser[0m[38;5;12m (https://github.com/uppusaikiran/malware-organiser) - A simple tool to organise large malicious/benign files into a organised Structure.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPafish[0m[38;5;12m (https://github.com/a0rtega/pafish) - Paranoid Fish, a demonstration[39m
[38;5;12m  tool that employs several techniques to detect sandboxes and analysis[39m
[38;5;12m  environments in the same way as malware families do.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mREMnux[0m[38;5;12m (https://remnux.org/) - Linux distribution and docker images for[39m
[38;5;12m  malware reverse engineering and analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mTsurugi Linux[0m[38;5;12m (https://tsurugi-linux.org/) - Linux distribution designed to support your DFIR investigations, malware analysis and OSINT (Open Source INTelligence) activities.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSantoku Linux[0m[38;5;12m (https://santoku-linux.com/) - Linux distribution for mobile[39m
[38;5;12m  forensics, malware analysis, and security.[39m

[38;5;12m                                                                                                                 [39m[38;2;255;187;0m[1m[4mResources[0m

[38;2;255;187;0m[4mBooks[0m

[48;2;30;30;40m[38;5;13m[3mEssential malware analysis reading material.[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mLearning Malware Analysis[0m[38;5;12m (https://www.packtpub.com/networking-and-servers/learning-malware-analysis) - Learning Malware Analysis: Explore the concepts, tools, and techniques to analuze and investigate Windows malware[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Analyst's Cookbook and DVD[0m[38;5;12m (https://amzn.com/dp/0470613033) -[39m
[38;5;12m  Tools and Techniques for Fighting Malicious Code.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMastering Malware Analysis[0m
[38;5;12m (https://www.packtpub.com/networking-and-servers/mastering-malware-analysis) - Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercime, and IoT attacks[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMastering Reverse Engineering[0m[38;5;12m (https://www.packtpub.com/networking-and-servers/mastering-reverse-engineering) - Mastering Reverse Engineering: Re-engineer your ethical hacking skills[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPractical Malware Analysis[0m[38;5;12m (https://amzn.com/dp/1593272901) - The Hands-On[39m
[38;5;12m  Guide to Dissecting Malicious Software.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPractical Reverse Engineering[0m[38;5;12m (https://www.amzn.com/dp/1118787315/) -[39m
[38;5;12m  Intermediate Reverse Engineering.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mReal Digital Forensics[0m[38;5;12m (https://www.amzn.com/dp/0321240693) - Computer[39m
[38;5;12m  Security and Incident Response.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRootkits and Bootkits[0m[38;5;12m (https://www.amazon.com/dp/1593277164) - Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThe Art of Memory Forensics[0m[38;5;12m (https://amzn.com/dp/1118825098) - Detecting[39m
[38;5;12m  Malware and Threats in Windows, Linux, and Mac Memory.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThe IDA Pro Book[0m[38;5;12m (https://amzn.com/dp/1593272898) - The Unofficial Guide[39m
[38;5;12m  to the World's Most Popular Disassembler.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThe Rootkit Arsenal[0m[38;5;12m (https://amzn.com/dp/144962636X) - The Rootkit Arsenal:[39m
[38;5;12m  Escape and Evasion in the Dark Corners of the System[39m

[38;2;255;187;0m[4mOther[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAPT Notes[0m[38;5;12m (https://github.com/aptnotes/data) - A collection of papers[39m
[38;5;12m  and notes related to Advanced Persistent Threats.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mEmber[0m[38;5;12m (https://github.com/endgameinc/ember) - Endgame Malware BEnchmark for Research,[39m
[38;5;12m  a repository that makes it easy to (re)create a machine learning model that can be used[39m
[38;5;12m  to predict a score for a PE file based on static analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mFile Formats posters[0m[38;5;12m (https://github.com/corkami/pics) - Nice visualization[39m
[38;5;12m  of commonly used file format (including PE & ELF).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneynet Project[0m[38;5;12m (http://honeynet.org/) - Honeypot tools, papers, and[39m
[38;5;12m  other resources.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mKernel Mode[0m[38;5;12m (http://www.kernelmode.info/forum/) - An active community[39m
[38;5;12m  devoted to malware analysis and kernel development.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalicious Software[0m[38;5;12m (https://zeltser.com/malicious-software/) - Malware[39m
[38;5;12m  blog and resources by Lenny Zeltser.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Analysis Search[0m[38;5;12m (https://cse.google.com/cse/home?cx=011750002002865445766%3Apc60zx1rliu) -[39m
[38;5;12m  Custom Google search engine from [39m[38;5;14m[1mCorey Harrell[0m[38;5;12m (journeyintoir.blogspot.com/).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Analysis Tutorials[0m[38;5;12m (http://fumalwareanalysis.blogspot.nl/p/malware-analysis-tutorials-reverse.html) -[39m
[38;5;12m  The Malware Analysis Tutorials by Dr. Xiang Fu, a great resource for learning[39m
[38;5;12m  practical malware analysis.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Analysis, Threat Intelligence and Reverse Engineering[0m[38;5;12m (https://www.slideshare.net/bartblaze/malware-analysis-threat-intelligence-and-reverse-engineering) -[39m
[38;5;12m  Presentation introducing the concepts of malware analysis, threat intelligence[39m
[38;5;12m  and reverse engineering. Experience or prior knowledge is not required. Labs[39m
[38;5;12m  link in description.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Persistence[0m[38;5;12m (https://github.com/Karneades/malware-persistence) - Collection[39m
[38;5;12m  of various information focused on malware persistence: detection (techniques),[39m
[38;5;12m  response, pitfalls and the log collection (tools).[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Samples and Traffic[0m[38;5;12m (http://malware-traffic-analysis.net/) - This[39m
[38;5;12m  blog focuses on network traffic related to malware infections.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mMalware Search+++[0m[38;5;12m (https://addons.mozilla.org/fr/firefox/addon/malware-search-plusplusplus/) Firefox extension allows[39m
[38;5;12m  you to easily search some of the most popular malware databases[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPractical Malware Analysis Starter Kit[0m[38;5;12m (https://bluesoul.me/practical-malware-analysis-starter-kit/) -[39m
[38;5;12m  This package contains most of the software referenced in the Practical Malware[39m
[38;5;12m  Analysis book.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mRPISEC Malware Analysis[0m[38;5;12m (https://github.com/RPISEC/Malware) - These are the[39m
[38;5;12m  course materials used in the Malware Analysis course at at Rensselaer Polytechnic[39m
[38;5;12m  Institute during Fall 2015.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWindowsIR: Malware[0m[38;5;12m (http://windowsir.blogspot.com/p/malware.html) - Harlan[39m
[38;5;12m  Carvey's page on Malware.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mWindows Registry specification[0m[38;5;12m (https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md) -[39m
[38;5;12m  Windows registry file format specification.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m/r/csirt_tools[0m[38;5;12m (https://www.reddit.com/r/csirt_tools/) - Subreddit for CSIRT[39m
[38;5;12m  tools and resources, with a[39m
[38;5;12m  [39m[38;5;14m[1mmalware analysis[0m[38;5;12m (https://www.reddit.com/r/csirt_tools/search?q=flair%3A%22Malware%20analysis%22&sort=new&restrict_sr=on) flair.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m/r/Malware[0m[38;5;12m (https://www.reddit.com/r/Malware) - The malware subreddit.[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m/r/ReverseEngineering[0m[38;5;12m (https://www.reddit.com/r/ReverseEngineering) -[39m
[38;5;12m  Reverse engineering subreddit, not limited to just malware.[39m



[38;5;12m                                                                                                           [39m[38;2;255;187;0m[1m[4mRelated Awesome Lists[0m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAndroid Security[0m[38;5;12m (https://github.com/ashishb/android-security-awesome)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mAppSec[0m[38;5;12m (https://github.com/paragonie/awesome-appsec)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mCTFs[0m[38;5;12m (https://github.com/apsdehal/awesome-ctf)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mForensics[0m[38;5;12m (https://github.com/Cugu/awesome-forensics)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1m"Hacking"[0m[38;5;12m (https://github.com/carpedm20/awesome-hacking)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mHoneypots[0m[38;5;12m (https://github.com/paralax/awesome-honeypots)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIndustrial Control System Security[0m[38;5;12m (https://github.com/hslatman/awesome-industrial-control-system-security)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mIncident-Response[0m[38;5;12m (https://github.com/meirwah/awesome-incident-response)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mInfosec[0m[38;5;12m (https://github.com/onlurking/awesome-infosec)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPCAP Tools[0m[38;5;12m (https://github.com/caesar0301/awesome-pcaptools)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mPentesting[0m[38;5;12m (https://github.com/enaqx/awesome-pentest)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mSecurity[0m[38;5;12m (https://github.com/sbilly/awesome-security)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mThreat Intelligence[0m[38;5;12m (https://github.com/hslatman/awesome-threat-intelligence)[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;14m[1mYARA[0m[38;5;12m (https://github.com/InQuest/awesome-yara)[39m

[38;5;12m                                                                                                       [39m[38;5;14m[1m[4mContributing[0m[38;2;255;187;0m[1m[4m (CONTRIBUTING.md)[0m

[38;5;12mPull requests and issues with suggestions are welcome! Please read the[39m
[38;5;14m[1mCONTRIBUTING[0m[38;5;12m (CONTRIBUTING.md) guidelines before submitting a PR.[39m

[38;5;12m                                                                                                                   [39m[38;2;255;187;0m[1m[4mThanks[0m

[38;5;12mThis list was made possible by:[39m

[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mLenny Zeltser and other contributors for developing REMnux, where I[39m
[38;5;12m  found many of the tools in this list;[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mMichail Hale Ligh, Steven Adair, Blake Hartstein, and Mather Richard for[39m
[38;5;12m  writing the [39m[48;2;30;30;40m[38;5;13m[3mMalware Analyst's Cookbook[0m[38;5;12m, which was a big inspiration for[39m
[38;5;12m  creating the list;[39m
[48;5;12m[38;5;11m⟡[49m[39m[38;5;12m [39m[38;5;12mAnd everyone else who has sent pull requests or suggested links to add here![39m

[38;5;12mThanks![39m
