FileInsight-plugins: decoding toolbox of McAfee FileInsight hex editor for malware analysis

FileInsight-plugins is a large set of plugins for McAfee FileInsight hex editor. It adds many capabilities such as decryption, decompression, searching XOR-ed text strings, scanning with a YARA rule, code emulation, disassembly, and more! It is useful for various kinds of decoding tasks in malware analysis (e.g. extracting malware executables and decoy documents from malicious document files).

For those looking for FileInishgt installer, it is available at https://downloadcenter.trellix.com/products/mcafee-avert/fileinsight.msi.

• Screenshots
• Presentations
• Use cases
• How to install
• How to use
• How to update
• Customization
• List of plugins (153 plugins)

Screenshots

Dialog of "AES decrypt" plugin

Scan result of "YARA scan" plugin

Data structure of ELF executable file parsed by "Parse file structure" plugin

Emulation trace of ARM64 Linux shellcode emulated by "Emulate code" plugin

Disassembly output of x86 Linux shellcode disassembled by "Disassemble" plugin

Bitmap representation of Windows executable file visualized by "Bitmap view" plugin

Byte histogram of Excel file shown by "Byte histogram" plugin

Entropy graph of Windows executable file shown by "Entropy graph" plugin

Presentations

Black Hat USA 2021 Arsenal

• Abstract at Black Hat USA website
• Slide deck
• Demo movie

CODE BLUE 2019 Bluebox

• Abstract at CODE BLUE website
• Slide deck (English)
• Slide deck (Japanese)

Use cases

• Use case 1: executable file embedded in Excel file
• Use case 2: executable file embedded in RTF file
• Use case 3: obfuscated PHP webshell
• Use case 4: YARA rule testing
• Use case 5: Code emulation

How to install

Please execute the following command. The latest release version of FileInsight-plugins and pre-requisites including FileInsight and Python 3.12.x (x64) will be installed.

powershell -exec bypass -command "IEX((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1'))"

If you use a proxy server (for example, IP address: 10.0.0.1, port: 8080), please execute the following commands.

curl -x http://10.0.0.1:8080 -Lo install.ps1 https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1
powershell -exec bypass .\install.ps1

There are a few Python modules that is necessary manual installation. Please follow installation instructions displayed by plugins.

How to use

Please click "Operations" in the "Plugins" tab then select a plugin.

You can also use plugins from the right-click menu.

Some plugins show an additional dialog for plugin settings at the point of use.

How to update

If you would like to update FileInsight-plugins to the latest release version, please click "Check for update" of the plugin menu. The installation PowerShell script (https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1) will be executed if new version is available. Existing files will be overwritten.

You can also update with the following command ("Check for update" executes this command).

powershell -exec bypass -command "& ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1'))) -update"

If you use a proxy server (for example, IP address: 10.0.0.1, port: 8080), please execute the following commands.

curl -x http://10.0.0.1:8080 -Lo install.ps1 https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1
powershell -exec bypass .\install.ps1 -update

If you would like to update FileInsight-plugins to the latest snapshot, please add "-snapshot" option.

powershell -exec bypass -command "& ([scriptblock]::Create((New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/nmantani/FileInsight-plugins/master/install.ps1'))) -update -snapshot"

Customization

For the "Send to (CLI)" plugin and the "Send to (GUI)" plugin, you can open files with your favorite programs. Please click "Customize menu" of the plugin menu.