Bletchley13 / MalwareResourceScanner

Scanning and identifying XOR encrypted PE files in PE resources

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Malware Resource Scanner

Malware Resource Scanner can identify PE files which are hidden in other PE file resources which are encrypted by an XOR key (up to an 8 Byte key). You can scan single files and you can also scan a directory and automatically unpack found hidden PE files. If MSR can't detect your hidden PE file then you must update the g_SearchInfoArray in ResourceParser.h.

Usage

Malware Resource Scanner v0.1 by Esmid Idrizovic
27. October 2011

Usage:
mrs.exe <optional parameters> <filepath>
      -d <path>                  Scans directory
      -unpack                    Auto unpack found files
      -quickscan                 Quick-Scan Windows start up programs
      -scannonpefiles            Try to unpack also non-PE files (like unknown file formats)

About

Scanning and identifying XOR encrypted PE files in PE resources