idiom

cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

findcrypt-yara

IDA pro plugin to find crypto constants (and more)

peepdf

Powerful Python tool to analyze PDF documents

ABD

Course materials for Advanced Binary Deobfuscation by NTT Secure Platform Laboratories

libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

yara-x

A rewrite of YARA in Rust.

GoReSym

Go symbol recovery tool

msoffice

ollydbg-script

some ollydbg scripts.

smda

SMDA is a minimalist recursive disassembler library that is optimized for accurate Control Flow Graph (CFG) recovery from memory dumps.

PyPowerShellXray

Python script to decode common encoded PowerShell scripts

Tools

Combination of different utilities, have fun!

symless

frida-wshook

Script analysis tool based on Frida.re

ursadb

Trigram database written in C++, suited for malware indexing

mlib

Your bag of handy codes for malware researchers

Manati

A web-based tool to assist the work of the intuitive threat analysts.

dotnetfile

sflock

Sample staging & detonation utility to be used in combination with Cuckoo Sandbox.

dnfile

Parse .NET executable files.

tools

Tools developed by the Zscaler ThreatLabz Threat Intelligence team

IAT-Tracer

An automation plugin for Tiny-Tracer framework to trace functions directly out of the executable's import table.

gopep

Go Lang Portable Executable Parser

elfesteem

Automatically exported from code.google.com/p/elfesteem

hansel

Hansel - a simple but flexible search for IDA

UnpacMe-IDA-Byte-Search

UnpacMe IDA Byte Search

GraphSlick

IDA Plugin - GraphSlick

dirhistory

Remember previous directories in bash and define keyboard shortcuts to change current directory to previous/next entries in history.

hollows_hunter

A process scanner detecting and dumping hollowed PE modules.