[  ](<https://2.bp.blogspot.com/-Nwb9Eae9MLo/VbqmExK4wpI/AAAAAAAAEb0/NIdUe4sYl9g/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-1.jpg>)
Hook Analyser is a freeware application which allows an investigator/analyst to perform “static & run-time / dynamic” analysis of suspicious applications, also gather (analyse & co-related) threat intelligence related information (or data) from various open sources on the Internet.
Essentially it’s a malware analysis tool that has evolved to add some cyber threat intelligence features & mapping.
Hook Analyser is perhaps the only “free” software in the market which combines analysis of malware analysis and cyber threat intelligence capabilities. The software has been used by major Fortune 500 organisations.
** Features/Functionality **
* Spawn and Hook to Application – Enables you to spawn an application, and hook into it
* Hook to a specific running process – Allows you to hook to a running (active) process
* Static Malware Analysis – Scans PE/Windows executables to identify potential malware traces
* Application crash analysis – Allows you to analyse memory content when an application crashes
* Exe extractor – This module essentially extracts executables from running process/s
** Release **
On this releases, significant improvements and capabilities have been added to the Threat Intelligence module.
Following are the key improvements and enhanced features -
* The malware analysis module has been improved - and new signatures have been added
* Cyber Threat Intelligence module -
* IP Intelligence module (Analyse multiple IP addresses instead of just 1!). Sample output -
[  ](<https://4.bp.blogspot.com/-dJVyMoaLE9M/VauIOFimhhI/AAAAAAAACRQ/-zFU3PffeZ4/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-10.jpg>)
* Keyword Intelligence module (Analyse keywords e.g. Internet Explorer 11, IP address, Hash etc). Sample output -
[  ](<https://2.bp.blogspot.com/-xtXlP37uoBw/VauIhj1tRRI/AAAAAAAACRY/xMbM3IQpD9U/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-11.jpg>)
[  ](<https://3.bp.blogspot.com/-kBKT5g8E1KI/VauI0MlLTiI/AAAAAAAACRg/-968mwPM5pM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-12.jpg>)
* Network file (PCAP) analysis - Analyse user-provided .PCAP file and performs analysis on external IP addresses. Example -
[  ](<https://3.bp.blogspot.com/-Lbf_LPdtiP8/VauKCVyw6XI/AAAAAAAACRo/CVihL7_XxXQ/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-13.jpg>)
[  ](<https://4.bp.blogspot.com/-OIKNjK9bXXo/VauKEAZ1mgI/AAAAAAAACRw/ROZtxUsfmLI/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-14.jpg>)
* Social Intelligence (Pulls data from Twitter- for user-defined keywords and performs network analysis). Example -
[  ](<https://1.bp.blogspot.com/-ngDnXkQiE6s/VauKdL6ivHI/AAAAAAAACR4/fCm79Hi46w4/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-15.jpg>)
[  ](<https://2.bp.blogspot.com/-pKNyQ8FAQNo/VauKdtYwKjI/AAAAAAAACR8/-rOaJcgvwGc/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-16.jpg>)
Let's look at "HOW-TO-USE" of this releases (Cyber Threat Intelligence) -
The tool can perform analysis via 2 methods - auto mode and manual mode.
In the auto mode, the tool will use the following files for analysis -
1. Channels.txt (Path: feeds->channels.txt): Specify the list of the twitter related channels or keywords for monitoring. In the Auto mode, the monitoring is performed for 2 minutes only, however if you'd like to monitor indefinitely, please select the manual mode.
* Example -
[  ](<https://2.bp.blogspot.com/-ciBnrkDV-Ro/VauEclDas3I/AAAAAAAACQY/VQSjoZYoqMU/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-3.jpg>)
* intelligence-ipdb.txt (Path: feeds->intelligence-ipdb.txt): Specify the list of IP addresses you'd like to analyse. Yes, you can provide as many IPs you'd like to.
* Example -
[  ](<https://2.bp.blogspot.com/-l0sNt2QJMEU/VauEsFc4nfI/AAAAAAAACQg/eyaw4W8zgLg/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-4.jpg>)
* Keywords.txt (Path: feeds->Keywords.txt): Specify the list of keywords you'd like to analyse. Yes, you can provide as many keywords you'd like to.
* Example -
[  ](<https://1.bp.blogspot.com/-GN4pBjKUpKQ/VauFGbs5J3I/AAAAAAAACQo/2l6oneLT4IM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-5.jpg>)
* rssurl.txt (Path: feeds->rssurl.txt): Specify the RSS feeds to fetch vulnerability-related information.
* Example -
[  ](<https://1.bp.blogspot.com/-AcJlhgD2Wuw/VauFfEC5jnI/AAAAAAAACQw/PiTcP5s-6eo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-6.jpg>)
* url.txt (Path: feeds->url.txt): Specify the list of the URLs from where tool will pull malicious IP addresses information.
* Example -
[  ](<https://2.bp.blogspot.com/-_m3yjr6bFNk/VauF2BTUThI/AAAAAAAACQ4/cd-Ua1PfZMs/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-7.jpg>)
Threat Intel module can be executed from HookAnalyser3.2.exe (option #6) file or can be executed directly through ThreatIntel.exe file. Refer to the following screenshots -
[  ](<https://2.bp.blogspot.com/-36X8aydhXR0/VauGp97StrI/AAAAAAAACRA/_5jka9j8oC0/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-8.jpg>)
[  ](<https://4.bp.blogspot.com/-oU97VTZBmUM/VauHwYonmEI/AAAAAAAACRI/7lhxxcPnhDM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-9.jpg>)
[  ](<https://4.bp.blogspot.com/-kX04k6LJEDQ/VauMTcLtXWI/AAAAAAAACSQ/3nkC5Ba_PSA/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-17.jpg>)
[  ](<https://1.bp.blogspot.com/-XaAd53eNFGw/VauMTFijjoI/AAAAAAAACSM/89xP-Gs6Bpo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-18.jpg>)
In manual mode, you'd need to provide filename as an argument. Example below -
[  ](<https://4.bp.blogspot.com/-Lbf_LPdtiP8/VauKCVyw6XI/AAAAAAAACRs/8KUdzNU0llw/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-13.jpg>)
[  ](<https://2.bp.blogspot.com/-OIKNjK9bXXo/VauKEAZ1mgI/AAAAAAAACR0/8PaV7CTzdPo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-14.jpg>)
** Important note - The software shall only be used for "NON-COMMERCIAL" purposes. For commercial usage, written permission from the Author must be obtained prior to use. **
** [ Download Hook Analyser 3.2 ](<https://docs.google.com/forms/d/14iXoERDGdatSABiqa66GnKu78Wju49Me2z_h6lUhBHk/viewform>) **
{"id": "KITPLOIT:4891187360029933566", "vendorId": null, "type": "kitploit", "bulletinFamily": "tools", "title": "Hook Analyser 3.2 - Malware Analysis Tool", "description": "[  ](<https://2.bp.blogspot.com/-Nwb9Eae9MLo/VbqmExK4wpI/AAAAAAAAEb0/NIdUe4sYl9g/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-1.jpg>)\n\n \n\n\nHook Analyser is a freeware application which allows an investigator/analyst to perform \u201cstatic & run-time / dynamic\u201d analysis of suspicious applications, also gather (analyse & co-related) threat intelligence related information (or data) from various open sources on the Internet. \n \n\n\nEssentially it\u2019s a malware analysis tool that has evolved to add some cyber threat intelligence features & mapping. \n\n \n\n\nHook Analyser is perhaps the only \u201cfree\u201d software in the market which combines analysis of malware analysis and cyber threat intelligence capabilities. The software has been used by major Fortune 500 organisations. \n \n\n\n** Features/Functionality **\n\n * Spawn and Hook to Application \u2013 Enables you to spawn an application, and hook into it \n * Hook to a specific running process \u2013 Allows you to hook to a running (active) process \n * Static Malware Analysis \u2013 Scans PE/Windows executables to identify potential malware traces \n * Application crash analysis \u2013 Allows you to analyse memory content when an application crashes \n * Exe extractor \u2013 This module essentially extracts executables from running process/s \n\n \n\n\n** Release **\n\n \n\n\nOn this releases, significant improvements and capabilities have been added to the Threat Intelligence module. \n\n \n\n\nFollowing are the key improvements and enhanced features - \n \n\n\n * The malware analysis module has been improved - and new signatures have been added \n * Cyber Threat Intelligence module - \n * IP Intelligence module (Analyse multiple IP addresses instead of just 1!). Sample output - \n\n[  ](<https://4.bp.blogspot.com/-dJVyMoaLE9M/VauIOFimhhI/AAAAAAAACRQ/-zFU3PffeZ4/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-10.jpg>)\n\n * Keyword Intelligence module (Analyse keywords e.g. Internet Explorer 11, IP address, Hash etc). Sample output - \n\n[  ](<https://2.bp.blogspot.com/-xtXlP37uoBw/VauIhj1tRRI/AAAAAAAACRY/xMbM3IQpD9U/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-11.jpg>)\n\n[  ](<https://3.bp.blogspot.com/-kBKT5g8E1KI/VauI0MlLTiI/AAAAAAAACRg/-968mwPM5pM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-12.jpg>)\n\n * Network file (PCAP) analysis - Analyse user-provided .PCAP file and performs analysis on external IP addresses. Example - \n\n[  ](<https://3.bp.blogspot.com/-Lbf_LPdtiP8/VauKCVyw6XI/AAAAAAAACRo/CVihL7_XxXQ/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-13.jpg>)\n\n \n\n\n[  ](<https://4.bp.blogspot.com/-OIKNjK9bXXo/VauKEAZ1mgI/AAAAAAAACRw/ROZtxUsfmLI/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-14.jpg>)\n\n * Social Intelligence (Pulls data from Twitter- for user-defined keywords and performs network analysis). Example - \n\n[  ](<https://1.bp.blogspot.com/-ngDnXkQiE6s/VauKdL6ivHI/AAAAAAAACR4/fCm79Hi46w4/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-15.jpg>)\n\n \n\n\n[  ](<https://2.bp.blogspot.com/-pKNyQ8FAQNo/VauKdtYwKjI/AAAAAAAACR8/-rOaJcgvwGc/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-16.jpg>)\n\n \nLet's look at \"HOW-TO-USE\" of this releases (Cyber Threat Intelligence) - \n \nThe tool can perform analysis via 2 methods - auto mode and manual mode. \n \nIn the auto mode, the tool will use the following files for analysis - \n \n\n\n 1. Channels.txt (Path: feeds->channels.txt): Specify the list of the twitter related channels or keywords for monitoring. In the Auto mode, the monitoring is performed for 2 minutes only, however if you'd like to monitor indefinitely, please select the manual mode. \n * Example - \n\n[  ](<https://2.bp.blogspot.com/-ciBnrkDV-Ro/VauEclDas3I/AAAAAAAACQY/VQSjoZYoqMU/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-3.jpg>)\n\n* intelligence-ipdb.txt (Path: feeds->intelligence-ipdb.txt): Specify the list of IP addresses you'd like to analyse. Yes, you can provide as many IPs you'd like to. \n\n * Example - \n\n[  ](<https://2.bp.blogspot.com/-l0sNt2QJMEU/VauEsFc4nfI/AAAAAAAACQg/eyaw4W8zgLg/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-4.jpg>)\n\n* Keywords.txt (Path: feeds->Keywords.txt): Specify the list of keywords you'd like to analyse. Yes, you can provide as many keywords you'd like to. \n\n * Example - \n\n[  ](<https://1.bp.blogspot.com/-GN4pBjKUpKQ/VauFGbs5J3I/AAAAAAAACQo/2l6oneLT4IM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-5.jpg>)\n\n* rssurl.txt (Path: feeds->rssurl.txt): Specify the RSS feeds to fetch vulnerability-related information. \n\n * Example - \n\n[  ](<https://1.bp.blogspot.com/-AcJlhgD2Wuw/VauFfEC5jnI/AAAAAAAACQw/PiTcP5s-6eo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-6.jpg>)\n\n* url.txt (Path: feeds->url.txt): Specify the list of the URLs from where tool will pull malicious IP addresses information. \n\n * Example - \n\n[  ](<https://2.bp.blogspot.com/-_m3yjr6bFNk/VauF2BTUThI/AAAAAAAACQ4/cd-Ua1PfZMs/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-7.jpg>)\n\n \nThreat Intel module can be executed from HookAnalyser3.2.exe (option #6) file or can be executed directly through ThreatIntel.exe file. Refer to the following screenshots - \n \n\n\n[  ](<https://2.bp.blogspot.com/-36X8aydhXR0/VauGp97StrI/AAAAAAAACRA/_5jka9j8oC0/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-8.jpg>)\n\n[  ](<https://4.bp.blogspot.com/-oU97VTZBmUM/VauHwYonmEI/AAAAAAAACRI/7lhxxcPnhDM/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-9.jpg>)\n\n[  ](<https://4.bp.blogspot.com/-kX04k6LJEDQ/VauMTcLtXWI/AAAAAAAACSQ/3nkC5Ba_PSA/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-17.jpg>)\n\n \n\n\n[  ](<https://1.bp.blogspot.com/-XaAd53eNFGw/VauMTFijjoI/AAAAAAAACSM/89xP-Gs6Bpo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-18.jpg>)\n\n \nIn manual mode, you'd need to provide filename as an argument. Example below - \n \n\n\n[  ](<https://4.bp.blogspot.com/-Lbf_LPdtiP8/VauKCVyw6XI/AAAAAAAACRs/8KUdzNU0llw/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-13.jpg>)\n\n \n\n\n[  ](<https://2.bp.blogspot.com/-OIKNjK9bXXo/VauKEAZ1mgI/AAAAAAAACR0/8PaV7CTzdPo/s1600/Hook%2BAnalyser%2B3.2%2BScreenshot%2B-14.jpg>)\n\n \n** Important note - The software shall only be used for \"NON-COMMERCIAL\" purposes. For commercial usage, written permission from the Author must be obtained prior to use. ** \n \n \n\n\n** [ Download Hook Analyser 3.2 ](<https://docs.google.com/forms/d/14iXoERDGdatSABiqa66GnKu78Wju49Me2z_h6lUhBHk/viewform>) **\n", "published": "2015-07-30T22:42:01", "modified": "2015-07-30T22:42:01", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "http://www.kitploit.com/2015/07/hook-analyser-32-malware-analysis-tool.html", "reporter": "KitPloit", "references": [], "cvelist": [], "immutableFields": [], "lastseen": "2020-04-07T04:44:16", "viewCount": 44, "enchantments": {"dependencies": {}, "score": {"value": 0.6, "vector": "NONE"}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.6}, "toolHref": "https://docs.google.com/forms/d/14iXoERDGdatSABiqa66GnKu78Wju49Me2z_h6lUhBHk/viewform", "_state": {"dependencies": 1645298235, "score": 1659803227}, "_internal": {"score_hash": "e2816a86acf7cf202e5383b4d47ae168"}}
Hook Analyser 3.2 - Malware Analysis Tool