pe-bear
hasherezade/pe-bearPortable Executable reversing tool with a friendly GUI
binary-analysisforensicsmalware-analysis+3
hasherezade/pe-bearPortable Executable reversing tool with a friendly GUI
erocarrera/pefilepefile is a Python module to read and work with PE (Portable Executable) files
hasherezade/pe-sieveScans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).
glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
struppigel/portexJava library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness
theflink/hunt-sleeping-beaconsCallstack scanner that identifies IOCs of unpacked or injected C2 agents by analyzing thread idle behavior, unbacked memory, module stomping, APCs,…
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
mahlet-inc/hobbitsA multi-platform GUI for bit-based analysis, processing, and visualization
pandaadir05/ghostDetects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process…
0x0be/pepperAn open source script to perform malware static analysis on Portable Executable
struppigel/portexanalyzerguiGraphical interface for PortEx, a Portable Executable and Malware Analysis Library
netspooky/inhaleA malware analysis and classification tool.
mgeeky/msidumpMSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.
rhacknarok/hacksguardA blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.
dimareverse/nuitka-static-unpackerStatic-first research tool for unpacking Nuitka-compiled binaries: extracts constants, modules, recovers .pyc files, and generates analysis reports.
trolldbois/python-haystackProcess heap analysis framework - Windows/Linux - record type inference and forensics
michelcrypt4d4mus/yaralyzerVisually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.