awesome-malware-analysis

A free, web based anonymizer

VPN software and hosting solutions

An open source proxy server with some privacy features

The Onion Router, for browsing the web without leaving traces of the client IP

Conpot

ICS/SCADA honeypot

Cowrie

SSH honeypot, based on Kippo

DemoHunter

Low interaction Distributed Honeypots

Dionaea

Honeypot designed to trap malware

Glastopf

Web application honeypot

Create a virtual honeynet

Honeypot bundle Linux distro

Honeytrap

Opensource system for running, monitoring and managing honeypots

MHN

MHN is a centralized server for management and data collection of honeypots. MHN allows you to deploy sensors quickly and to collect data immediately, viewable from a neat web interface

Mnemosyne

A normalizer for honeypot data; supports Dionaea

Thug

Low interaction honeyclient, for investigating malicious websites

Realtime database of malware and malicious domains

A collection of recent malware samples and analyses

Exploit and shellcode samples

Malware samples collection and analysis

Evergrowing searchable corpus of malicious Microsoft documents

Javascript Mallware Collection

Collection of almost 40.000 javascript malware samples

A resource providing rapid identification and actionable context for malware investigations

Large repository of malware actively scrapped from malicious sites

Ragpicker

Plugin based malware crawler with pre-analysis and reporting functionalities

theZoo

Live malware samples for analysts

Agregator for malware corpus tracker and malicious download sites

Collection of various malware files and source code

Community-Based malware repository and social network

Malware database that detected by many anti malware programs except ClamAV

Malware repository, registration required

Active collection of malware samples

A list of malware sample sources put together by Lenny Zeltser

Zeus Source Code

Source for the Zeus trojan leaked in 2011

Massive and growing collection of free malware samples

AbuseHelper

An open-source framework for receiving and redistributing abuse feeds and threat intel

Share and collaborate in developing Threat Intelligence

Combine

Tool to gather Threat Intelligence indicators from publicly available sources

Fileintel

Pull intelligence per file hash

Hostintel

Pull intelligence per host

- A tool for CERTs for processing incident data using a message queue

- A free editor for XML IOC files

iocextract

Advanced Indicator of Compromise (IOC) extractor, Python library and command-line tool

ioc_writer

Python library for working with OpenIOC objects, from Mandiant

MalPipe

Malware/IOC ingestion and processing engine, that enriches collected data

Massive Octo Spice

- Previously known as CIF (Collective Intelligence Framework). Aggregates IOCs from various lists. Curated by the

MISP

Malware Information Sharing Platform curated by

Free, community-driven threat intelligence platform collecting IOCs from open-source feeds

PyIOCe

A Python OpenIOC editor

Research, connect, tag and share IPs and domains. (Was PassiveTotal.)

threataggregator

- Aggregates security threats from a number of sources, including some of those listed below in

TC Open allows you to see and share open source threat data, with support and validation from our free community

A search engine for threats, with graphical visualization

ThreatIngestor

Build automated threat intel pipelines sourcing from Twitter, RSS, GitHub, and more

ThreatTracker

A Python script to monitor and generate alerts based on IOCs indexed by a set of Google Custom Search Engines

TIQ-test

Data visualization and statistical analysis of Threat Intelligence feeds

( ) - Snort plugin and blocklist

- OSINT feeds based on malicious DGA algorithms

- Extensive malware config database (must request access)

( ) - Network security blocklists

Free intel aggregator with deduplication featuring 90+ feeds and over 1.2M indicators

Multiple botnet active tracker

FireEye IOCs

Indicators of Compromise shared publicly by FireEye

Analytics for 350+ IP lists with a focus on attacks, malware and abuse. Evolution, Changes History, Country Maps, Age of IPs listed, Retention Policy, Overlaps

Community driven honeypot sensor data collection and aggregation

hpfeeds

Honeypot feed protocol

( - - ) - Blocklist service

Continuous aggregation of IOCs from a variety of open reputation sources

Continuous aggregation of IOCs from a variety of blogs, Github repos, and Twitter

Diary and searchable incident database, with a web . ( )

Searchable incident database

Search and share malicious URLs

- List of the most looked up file hashes from MetaDefender Cloud

Framework for sharing threat intelligence

- Rulesets and more. (Formerly Emerging Threats.)

- A list of ransomware overview with details, detection and prevention

- Standardized language to represent and share cyber threat information. Related efforts from :

SystemLookup hosts a collection of lists that provide information on the components of legitimate and potentially unwanted programs

Data mining portal for threat intelligence, with search

Search for indicators, up to 1000 free per month

C2 panel tracker

Yara rules

Yara rules repository

YETI

Yeti is a platform meant to organize observables, indicators of compromise, TTPs, and knowledge on threats in a single, unified repository

ZeuS blocklists

AnalyzePE

Wrapper for a variety of tools for reporting on Windows PE files

A scalable file triage and malware analysis system integrating the cyber security community's best tools

BinaryAlert

An open source, serverless AWS pipeline that scans and alerts on uploaded files based on a set of YARA rules

capa

Detects capabilities in executable files

Local Linux rootkit detection

Open source antivirus engine

Detect It Easy(DiE)

A program for determining types of files

Packer, compressor detector, unpack info, internal exe tools

Read, write and edit file metadata

File Scanning Framework

- Modular, recursive file scanning solution

fn2yara

FN2Yara is a tool to generate Yara signatures for matching functions (code) in an executable program

Generic File Parser

A Single Library Parser to extract meta information,static analysis and detect macros within the files

hashdeep

Compute digest hashes with a variety of algorithms

HashCheck

Windows shell extension to compute hashes with a variety of algorithms

Loki

Host based scanner for IOCs

Malfunction

Catalog and compare malware at a function level

Manalyze

Static analyzer for PE executables

MASTIFF

Static analysis framework

MultiScanner

Modular file scanning/analysis framework

Nauz File Detector(NFD)

Linker/Compiler/Tool detector for Windows, Linux and MacOS

nsrllookup

A tool for looking up hashes in NIST's National Software Reference Library database

packerid

A cross-platform Python alternative to PEiD

Reversing tool for PE files

PEframe

PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents

A multiplatform toolkit to work with PE files, providing feature-rich tools for proper analysis of suspicious binaries

PortEx

Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness

Quark-Engine

An Obfuscation-Neglect Android Malware Scoring System

Detect Linux rootkits

Compute fuzzy hashes

- Python script for easy searching of the database

File identifier

Pattern matching tool for analysts

Yara rules generator

Generate yara rules based on a set of malware samples. Also contains a good strings DB to avoid false positives

Yara Finder

A simple tool to yara match the file against various yara rules to find the indicators of suspicion

Online sandbox

Online interactive sandbox

Free online analysis of APKs against multiple mobile antivirus apps

BoomBox

Automatic deployment of Cuckoo Sandbox malware lab using Packer and Vagrant

Analyze suspicious office documents

Open source, self hosted sandbox and automated analysis system

cuckoo-modified

Modified version of Cuckoo Sandbox released under the GPL. Not merged upstream due to legal concerns by the author

cuckoo-modified-api

A Python API used to control a cuckoo-modified sandbox

Multi-format file analyzer with machine-learning classification

detux

A sandbox developed to do traffic analysis of Linux malwares and capturing IOCs

DRAKVUF

Dynamic malware analysis system

Static malware analysis, VBA/Powershell/VBS/JS Emulation

Unpacks, scans and analyzes almost any firmware package

HaboMalHunter

An Automated Malware Analysis Tool for Linux ELF Files

Online malware analysis tool, powered by VxSandbox

Detect, analyze, and categorize malware by identifying code reuse and code similarities

An asynchronous and customizable analysis platform for suspicious files

Deep malware analysis with Joe Sandbox

Free online multi-AV scanner

Limon

Sandbox for Analyzing Linux Malware

Malheur

Automatic sandboxed analysis of malware behavior

malice.io

Massively scalable malware analysis framework

malsub

A Python RESTful API framework for online malware and URL analysis services

Extract, decode and display online the configuration settings from common malwares

Online malware anomaly-based static analyser with heuristic detection engine powered by data mining and machine learning

Free analysis with an online Cuckoo Sandbox instance

Scan a file, hash, IP, URL or domain address for malware for free

A service that analyzes pcap files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware using Suricata configured with EmergingThreats Pro

Noriben

Uses Sysinternals Procmon to collect information about malware in a sandboxed environment

PacketTotal is an online engine for analyzing .pcap files, and visualizing the network traffic within

Analyse suspicious PDF files

A graphical malware analysis tool kit

Recomposer

A helper script for safely uploading binaries to sandbox sites

sandboxapi

Python library for building integrations with several open source and commercial malware sandboxes

SEE

Sandboxed Execution Environment (SEE) is a framework for building test automation in secured Environments

Online dropper analysis (Js, VBScript, Microsoft Office, PDF)

Free online analysis of malware samples and URLs

Visualize_Logs

Open source visualization library and command line tools for logs. (Cuckoo, Procmon, more to come...)

Free automated sandboxes and services, compiled by Lenny Zeltser

AbuseIPDB is a project dedicated to helping combat the spread of hackers, spammers, and abusive activity on the internet

Community based IP blacklist service

boomerang

A tool designed for consistent and safe capture of off network web resources

Threat intelligence tracker, with IP/domain/hash search

One click tool to retrieve as much metadata as possible for a website and to assess its good standing

Free online dig and other network tools

dnstwist

Domain name permutation engine for detecting typo squatting, phishing and corporate espionage

IPinfo

Gather information about an IP or domain by searching online resources

Machinae

OSINT tool for gathering information about URLs, IPs, or hashes. Similar to Automator

mailchecker

Cross-language temporary email detection library

MaltegoVT

Maltego transform for the VirusTotal API. Allows domain/IP research, and searching for file hashes and scan reports

Multiple DNS blacklist and forward confirmed reverse DNS lookup over more than 300 RBLs

Free API Services for detecting possible phishing domains, blacklisted ip addresses and breached accounts

Phishing Statistics with search for IP, domain and website title

subdomains, whois, realted domains, DNS, hosts AS, SSL/TLS info,

Historical and current WHOIS, historical and current DNS records, similar domains, certificate information and other domain and IP related API and tools

IP based spam block list

Block list based on domains and IPs

Free Website Malware and Security Scanner

Search for IP, domain or network owner. (Previously SenderBase.)

OSINT tool for gathering information about URLs, IPs, or hashes

A project from abuse.ch with the goal of sharing malicious URLs that are being used for malware distribution

Free URL Scanner

Free URL Scanner & domain information

DomainTools free online whois search

Free online tools for researching malicious websites, compiled by Lenny Zeltser

Zulu URL Risk Analyzer

Bytecode Viewer

Combines multiple Java bytecode viewers and decompilers into one tool, including APK/DEX support

Firefox extension for web development

Decompile and inspect Java apps

Java IDX Parser

Parses Java IDX cache files

JavaScript malware analysis tool

jsunpack-n

A javascript unpacker that emulates browser functionality

Krakatau

Java decompiler, assembler, and disassembler

Analyze malicious web pages

RABCDAsm

A "Robust ActionScript Bytecode Disassembler."

- Static and dynamic analysis of SWF applications

Tools for working with Adobe Flash files

A Python script for analyzing Flash files

AnalyzePDF

A tool for analyzing PDFs and attempting to determine whether they are malicious

box-js

A tool for studying JavaScript malware, featuring JScript/WScript support and ActiveX emulation

Disassembler for analyzing malicious shellcode

Upload common malware lures for Deep File Inspection and heuristical analysis

JavaScript unpacking and deobfuscation

Library and tools for x86 shellcode emulation

malpdfobj

Deconstruct malicious PDFs into a JSON representation

Scan for malicious traces in MS Office documents

A script for parsing OLE and OpenXML documents and extracting useful information

A tool for analyzing malicious PDFs, and more

pdfid, pdf-parser, and more from Didier Stevens

PDF X-Ray Lite

A PDF analysis tool, the backend-free version of PDF X-RAY

Python tool for exploring possibly malicious PDFs

QuickSand is a compact C framework to analyze suspected malware documents to identify exploits in streams of different encodings and to locate and extract embedded executables

- Mozilla's JavaScript engine, for debugging malicious JS

bulk_extractor

Fast file carving tool

EVTXtract

Carve Windows Event Log files from raw binary data

File carving tool designed by the US Air Force

hachoir3

Hachoir is a Python library to view and edit a binary stream field by field

Scalpel

Another data carving tool

SFlock

Nested archive extraction/unpacking (used in Cuckoo Sandbox)

A malware analysis tool for reversing obfuscation (XOR, ROL, etc) and more

de4dot

.NET deobfuscator and unpacker

& - Two tools from Alexander Hanel for working with single-byte XOR encoded files

FLOSS

The FireEye Labs Obfuscated String Solver uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries

NoMoreXOR

Guess a 256 byte XOR key using frequency analysis

PackerAttacker

A generic hidden code extractor for Windows malware

PyInstaller Extractor

- A Python script to extract the contents of a PyInstaller generated Windows executable file. The contents of the pyz file (usually pyc files) present inside the executable are also extracted and automatically fixed so that a Python bytecode decompiler will recognize it

uncompyle6

A cross-version Python bytecode decompiler. Translates Python bytecode back into equivalent Python source code

un{i}packer

Automatic and platform-independent unpacker for Windows binaries based on emulation

unpacker

Automated malware unpacker for Windows malware based on WinAppDbg

unxor

Guess XOR keys using known-plaintext attacks

VirtualDeobfuscator

- Reverse engineering tool for virtualization wrappers

- A Python script for brute forcing single-byte XOR keys

- A couple programs from Didier Stevens for finding XORed data

xortool

Guess XOR key length, as well as the key itself

angr

Platform-agnostic binary analysis framework developed at UCSB's Seclab

Identifies and extracts information from bots and other malware

BAP

Multiplatform and open source (MIT) binary analysis framework developed at CMU's Cylab

BARF

Multiplatform, open source Binary Analysis and Reverse engineering Framework

binnavi

Binary analysis IDE for reverse engineering based on graph visualization

A reversing engineering platform that is an alternative to IDA

Binwalk

Firmware analysis tool

BluePill

Framework for executing and debugging evasive malware and protected executables

Capstone

Disassembly framework for binary analysis and reversing, with support for many architectures and bindings in several languages

codebro

Web based code browser using  clang to provide basic code analysis

GUI for Radare2

DECAF (Dynamic Executable Code Analysis Framework)

- A binary analysis platform based   on QEMU. DroidScope is now an extension to DECAF

dnSpy

.NET assembly editor, decompiler and debugger

Free .NET Decompiler and Assembly Browser

A modular debugger with a Qt GUI

Fibratus

Tool for exploration and tracing of the Windows kernel

Reports open TCP/IP and UDP ports in a live system and maps them to the owning application

The GNU debugger

GEF

GDB Enhanced Features, for exploiters and reverse engineers

Ghidra

A software reverse engineering (SRE) framework created and maintained by the National Security Agency Research Directorate

hackers-grep

A utility to search for strings in PE executables including imports, exports, and debug symbols

The macOS and Linux Disassembler

Windows disassembler and debugger, with a free evaluation version

IDR

Interactive Delphi Reconstructor is a decompiler of Delphi executable files and dynamic libraries

Debugger for malware analysis and more, with a Python API

ILSpy is the open-source .NET assembly browser and decompiler

DSL for file formats / network protocols / data structures reverse engineering and dissection, with code generation for C++, C#, Java, JavaScript, Perl, PHP, Python, Ruby

LIEF provides a cross-platform library to parse, modify and abstract ELF, PE and MachO formats

Dynamic analysis for Linux executables

mac-a-mal

An automated framework for mac malware hunting

Part of GNU binutils, for static analysis of Linux binaries

An assembly-level debugger for Windows executables

Dump memory from (unpacked) malware Windows process and store raw or rebuild PE file. This is a plugin for OllyDbg, Immunity Debugger, IDA Pro, WinDbg, and x64dbg

PANDA

Platform for Architecture-Neutral Dynamic Analysis

PEDA

Python Exploit Development Assistance for GDB, an enhanced display with added commands

Perform static analysis of Windows executables

Pharos

The Pharos binary analysis framework can be used to perform automated static analysis of binaries

plasma

Interactive disassembler for x86/ARM/MIPS

A Professional PE file Explorer for reversers, malware researchers and those who want to statically inspect PE files in more detail

- Advanced task manager for Windows

Tool that monitors system resources

- Advanced monitoring tool for Windows programs

Windows command-line tools that help manage and investigate live systems

Pyew

Python tool for malware analysis

PyREBox

Python scriptable reverse engineering sandbox by the Talos team at Cisco

Cross platform emulation and sanboxing framework with instruments for binary analysis

QKD

QEMU with embedded WinDbg server for stealth debugging

Reverse engineering framework, with debugger support

Registry compare utility that compares snapshots

Retargetable machine-code decompiler with an and that you can use in your tools

ROPMEMU

A framework to analyze, dissect and decompile complex code-reuse attacks

Scylla Imports Reconstructor

Find and fix the IAT of an unpacked / dumped PE32 malware

ScyllaHide

An Anti-Anti-Debug library and plugin for OllyDbg, x64dbg, IDA Pro, and TitanEngine

SMRT

Sublime Malware Research Tool, a plugin for Sublime 3 to aid with malware analyis

Dynamic analysis for Linux executables

StringSifter

A machine learning tool that automatically ranks strings based on their relevance for malware analysis

A dynamic binary analysis (DBA) framework

Udis86

Disassembler library and tool for x86 and x86_64

Vivisect

Python tool for malware analysis

multipurpose debugger for the Microsoft Windows computer operating system, used to debug user mode applications, device drivers, and the kernel-mode memory dumps

An open-source x64/x32 debugger for windows

Protocol analyzer that operates at incredible scale; both file and network protocols

BroYara

Use Yara rules from Bro

CapTipper

Malicious HTTP traffic explorer

chopshop

Protocol analysis and decoding framework

Web-based tool for packet analysis and malware traffic detection

FakeNet-NG

Next generation dynamic network analysis tool

Intercepting web proxy designed for "web debugging."

Hale

Botnet C&C monitor

An open source security oriented language for describing protocols and applying security policies on (live) captured traffic

HTTPReplay

Library for parsing and reading out PCAP files, including TLS streams using TLS Master Secrets (used in Cuckoo Sandbox)

Network service emulation, useful when building a malware lab

Laika BOSS

Laika BOSS is a file-centric malware analysis and intrusion detection system

Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files) and Zeek logs

Malcom

Malware Communications Analyzer

Maltrail

A malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails and featuring an reporting and analysis interface

Intercept network traffic on the fly

Moloch

IPv4 traffic capturing, indexing and database system

Network forensic analysis tool, with a free version

ngrep

Search through network traffic like grep

PcapViz

Network topology and traffic visualizer

Python ICAP Yara

An ICAP Server with yara scanner for URL or content

Squidmagic

squidmagic is a tool designed to analyze a web-based network traffic to detect central command and control (C&C) servers and malicious sites, using Squid proxy server and Spamhaus

Collect network traffic

Trach and reassemble TCP streams from network traffic

Extract files from network traffic

The network traffic analysis tool

Windows/MacOS forensics client supporting hiberfil, pagefile, raw memory analysis

DAMM

Differential Analysis of Malware in Memory, built on Volatility

evolve

Web interface for the Volatility Memory Forensics Framework

Find AES encryption keys in memory

inVtero.net

High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support

Muninn

A script to automate portions of analysis using Volatility, and create a readable report. - Orochi is an open source framework for collaborative forensic memory dump analysis

Memory analysis framework, forked from Volatility in 2013

TotalRecall

Script based on Volatility for automating various malware analysis tasks

VolDiff

Run Volatility on memory images before and after malware execution, and report changes

Volatility

Advanced memory forensics framework

VolUtility

Web Interface for Volatility Memory Analysis framework

WDBGARK

- WinDBG Anti-RootKit Extension

- Live memory inspection and kernel debugging for Windows systems

AChoir

A live incident response script for gathering Windows artifacts

python-evt

Python library for parsing Windows Event Logs

Python library for parsing registry files

( ) - Plugin-based registry analysis tool

Aleph

Open Source Malware Analysis Pipeline System

Collaborative Research Into Threats, a malware and threat repository

A malware analysis framework featuring a pipeline that can be extended with custom modules, which can be chained and interact with each other to perform end-to-end analysis

Malwarehouse

Store, tag, and search malware

Polichombr

A malware analysis platform designed to help analysts to reverse malwares collaboratively

Distributed content analysis framework with extensive plugin support, from input to output, and everything in between

A binary management and analysis framework for analysts and researchers

al-khaser

A PoC malware with good intentions that aimes to stress anti-malware systems

CryptoKnight

Automated cryptographic algorithm reverse engineering and classification framework

DC3-MWCP

- The Defense Cyber Crime Center's Malware Configuration Parser framework

FLARE VM

A fully customizable, Windows-based, security distribution for malware analysis

MalSploitBase

A database containing exploits used by malware

Collection of malware programs that were distributed in the 1980s and 1990s

Malware Organiser

A simple tool to organise large malicious/benign files into a organised Structure

Pafish

Paranoid Fish, a demonstration tool that employs several techniques to detect sandboxes and analysis environments in the same way as malware families do

Linux distribution and docker images for malware reverse engineering and analysis

Linux distribution designed to support your DFIR investigations, malware analysis and OSINT (Open Source INTelligence) activities

Linux distribution for mobile forensics, malware analysis, and security

Learning Malware Analysis: Explore the concepts, tools, and techniques to analuze and investigate Windows malware

- Tools and Techniques for Fighting Malicious Code

Mastering Malware Analysis: The complete malware analyst's guide to combating malicious software, APT, cybercime, and IoT attacks

Mastering Reverse Engineering: Re-engineer your ethical hacking skills

The Hands-On Guide to Dissecting Malicious Software

- Intermediate Reverse Engineering

Computer Security and Incident Response

Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats

Detecting Malware and Threats in Windows, Linux, and Mac Memory

The Unofficial Guide to the World's Most Popular Disassembler

The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System

APT Notes

A collection of papers and notes related to Advanced Persistent Threats

Ember

Endgame Malware BEnchmark for Research, a repository that makes it easy to (re)create a machine learning model that can be used to predict a score for a PE file based on static analysis

File Formats posters

Nice visualization of commonly used file format (including PE & ELF)

Honeypot tools, papers, and other resources

An active community devoted to malware analysis and kernel development

Malware blog and resources by Lenny Zeltser

- Custom Google search engine from

- The Malware Analysis Tutorials by Dr. Xiang Fu, a great resource for learning practical malware analysis

- Presentation introducing the concepts of malware analysis, threat intelligence and reverse engineering. Experience or prior knowledge is not required. Labs link in description

Malware Persistence

Collection of various information focused on malware persistence: detection (techniques), response, pitfalls and the log collection (tools)

This blog focuses on network traffic related to malware infections

Firefox extension allows you to easily search some of the most popular malware databases

- This package contains most of the software referenced in the Practical Malware Analysis book

RPISEC Malware Analysis

These are the course materials used in the Malware Analysis course at at Rensselaer Polytechnic Institute during Fall 2015

Harlan Carvey's page on Malware

Windows Registry specification

- Windows registry file format specification

Subreddit for CSIRT tools and resources, with a flair

The malware subreddit

- Reverse engineering subreddit, not limited to just malware