
malware-research
Code written as part of our various malware investigations

Code written as part of our various malware investigations

Deobfuscator for javascript-obfuscator 5.x output (string arrays, control-flow flattening, self-defending, RC4/base64)

match functions in binaries by what they do, not what their bytes look like. behavioral function fingerprinting via microexecution.

A script to detect stack-strings by using emulation (leveraging Unicorn)

x64 Dynamic Reverse Engineering Toolkit

Golang bindings for PE-sieve

VMUnprotect.Dumper can dynamically untamper VMProtected Assembly.

An API hooking framework for intercepting and monitoring Windows applications

An strace-like program for the Windows 'native' API

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

NebulaPulsar is a proof-of-concept in-memory implant framework for Java (JSP) and ASP.NET (ASPX/ASHX/ASMX) webshells, originally developed as part of…