RansomLord

RansomLord NG v1.0 Anti-Ransomware exploit tool. Proof-of-concept tool that automates the creation of PE files, used to exploit ransomware pre-encryption. Updated version NG: https://github.com/malvuln/RansomLord/releases/tag/v1.0 Lang: C SHA256:...

AsmResolver

AsmResolver AsmResolver is a library for reading, modifying and reconstructing Portable Executable PE files. It supports PE images running natively on Windows, as well as images containing managed .NET metadata. AsmResolver is released under the MIT license. Main Features AsmResolver has a lot of...

Windows-SignedBinary

Generate Windows Signed Binary With a Different Hash The idea was to bypass endpoint solution that block known "malicious" signed application such as "regsvr32.exe". I wanted to find a way to get a valid signed file with a different hash. The Analysis Using signtool verify /v /a cmd.exe...

packer-tutorial

Table of Contents 1. What is a packer? : An introduction into the purpose of packers and a guide through what the development necessities of a packer are. 2. Prerequisites : Tools needed to work with this tutorial. 3. Getting a taste : A demonstration of what you will be building with this...

IATelligence

IATelligence IATelligence is a Python script that extracts the Import Address Table IAT from a PE file and uses OpenAI's GPT-3 model to provide details about each Windows API imported by the file. The script also searches for related MITRE ATT&CK techniques and explains how the API could...

libpeconv

libPeConv A library to load and manipulate PE files. Objectives The goal of libPEConv was to create a "swiss army knife" for custom loading of PE files. It gathers various helper functions that you can quickly integrate in your own loader. For example: remapping sections, applying relocations,...

SigFlip

What is it ? SigFlip is a tool for patching authenticode signed PE files exe, dll, sys ..etc in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data i.e shellcode without breaking the file signature, integrit...

XPEViewer

PE file viewer/editor for Windows, Linux and MacOS. Download: https://github.com/horsicq/XPEViewer/releases How to run: https://github.com/horsicq/XPEViewer/blob/master/docs/RUN.md How to build: https://github.com/horsicq/XPEViewer/blob/master/docs/BUILD.md Changelog:...

SSMA

SSMA SSMA is a simple malware analyzer written in Python 3. Features: Analyze PE file's header and sections number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc. Analyze ELF file for Linux malware analysis, it uses...

InfectPE

Using this tool you can inject x-code/shellcode into PE file. InjectPE works only with 32-bit executable files. Why you need InjectPE? You can test your security products. Use in a phishing campaign. Learn how PE injection works. ...and so on. In the project, there is hardcoded x-code of...

cve-2021-40444

cve-2021-40444 Reverse engineering the "A Letter Before Court 4.docx" malicious files exploting cve-2021-40444 Files including malicious word and cab-file may be downloaded on any.run: https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ Note! The domain name in the original malicious...

MalScan

MalScan MalScan is a simple PE File Heuristics Scanners written in python that you can use to quickly analyze a PE file and find out whether anything suspicious exists. It is a simple tool so doesn't offers much fancy features. You are free to extend it or do whatever you want with it. Things...

pecli

PEcli Tool to analyze PE files in python 3. Current features : Show information about the file import, exports, resources Search for interesting information in the file abnormal resources, peid... Dump sections or resources Check size Search for a string in the file Installation You can install i...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

HintInject

HintInject HintInject is a shellcode embedder and loader that I developed while playing with the PE file and Import Directory Table structures. It takes a raw shellcode file and puts the shellcode in chunks into the Hint/Name Table entries which are reachable via the Import Lookup Table of a fake...

PhaseDump

PhaseDump Python tool for decrypting W32/Phase modules, first 16-bytes is the MD5 hash of decrypted code, rest is PE file RC4 encrypted with "Phase" as the key...

interactive-binary-structures

Interactive Binary Structures An interactive web-based toolkit designed to bridge the gap between theoretical documentation and practical analysis of binary formats and system memory layouts. Portable Executable PE Format Documentation This tool serves as an interactive visual map of a Windows PE...

TABPE

TABPE What is TABPE? TABPE a combination of TABriz + PE - Tabriz is my hometown, and I named this project after my love for my city is an open, structured dataset containing information about all PE files Windows executables including .exe, .dll, .sys, etc., on clean, fully updated versions of...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage .\ExportDump dllpath e.g. .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from C:\windows\system32\version.dll. + Dumping done...