Manalyze

Manalyze 简介 Manalyze 是一款针对 PE 文件的静态分析工具，可用于对可执行文件（或一组可执行文件）进行初步评估。它收集可能指示恶意行为的微弱信号，并显示有助于后续手动分析的信息。 如果您想查看该工具生成的示例报告，请随意试用我为其创建的网络服务：manalyzer.org。 目录 PE文件的静态分析器 如何构建 生成ClamAV规则 使用 使用Manalyze的用户 联系方式 PE文件的静态分析器 Manalyze 使用 C++ 编写，支持 Windows 和 Linux，并根据 GPLv3 许可证 发布。它是一款健壮的 PE...

iocx

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...

file-unpumper

file-unpumper file-unpumper 是一款强大的命令行工具，用于清理和分析可移植可执行（PE）文件。它提供了丰富的功能，帮助开发者和安全专业人士更高效地处理 PE 文件。 功能特性 PE 头修复 : file-unpumper 可以修复并对齐给定可执行文件的 PE 头。这对于解决由加壳器或混淆器修改头文件引起的问题特别有用。 资源提取 : 该工具能够提取 PE 文件中嵌入的资源，如图标、位图或其他数据资源。这有助于逆向工程或分析可执行文件的内容。 元数据分析 : file-unpumper 提供对 PE...

hacksguard

Hacksguard 0.2 - 极速 TUI 恶意软件分析工具 🛡️ Hacksguard 是一款极速、多线程的终端界面（TUI）静态分析工具，专为 SOC 分析师、威胁猎手和逆向工程师设计。完全使用 Rust 构建，在终端中提供直观的仪表盘，用于快速分类和深度检查可移植可执行文件（PE）。 🌟 主要特性 极速且多线程 ：核心分析流水线（PE 解析、YARA 扫描和熵计算）可并发运行。即使在分析大型可执行文件时，也能确保零界面延迟。 高级风险评分 ：Hacksguard 自动基于 5 个启发式维度（熵、可疑 API、PE 异常、字符串和加壳）计算 0–100% 的...

Alcatraz

Alcatraz Alcatraz es un ofuscador de binarios x64 que puede ofuscar varios archivos PE diferentes, incluyendo: .exe .dll .sys Descripción general Alcatraz Requisitos Uso Características Ofuscación de movimientos inmediatos Aplanamiento del flujo de control Mutación ADD Ofuscación del punto de...

zig-pe

zig-pe 用Zig编写的反射式PE加载器。直接从内存加载并执行原生和.NET PE文件。 特性 PE加载流水线 解析DOS和NT头（运行时支持PE32和PE32+） 将节映射到分配的内存 解析导入（按名称和序号，PE32 4字节/PE32+ 8字节跳转表） 应用基址重定位（HIGHLOW, DIR64, ARMMOV32, THUMBMOV32） 解析延迟导入（DataDirectory13，现代RVA格式） 注册异常处理程序（仅x64/ARM64的RtlAddFunctionTable） 设置每节的内存保护 调用TLS回调（DLLPROCESSATTACH）...

tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say root@kitploit: sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say...

pe2pic

简体中文 || English pe2pic 用于PE文件的小型可视化工具 入门指南 通过以下方式安装依赖项: root@kitploit: pip install -r requirements.txt 用法 root@kitploit: usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE可视化工具 可选项: -h, --help 显示帮助消息并退出 --infile INFILE 输入文件 --outfile OUTFILE 输出文件 --double...

pe-bear-old

PE-bear 发布版 PE-bear 是一款用于 PE 文件的免费逆向工具。其目标是快速、灵活地为恶意软件分析师提供“第一视图”，同时保持稳定并能够处理畸形 PE 文件。 适用于 PE-bear 的签名： SIG.txt 更新于：22.01.2014 - 包含来自PEid 的 UserDB 的签名 - 由 crashish 提供的脚本转换 也可通过 Chocolatey 获取 !!! 更新 !!! - 自 18 September 2022 起，PE-bear 已开源！ 代码和新的构建版本可在此处获取：https://github.com/hasherezade/pe-bear...

pe_tree

PE Tree PE Tree is a Python module for viewing Portable Executable PE files in a tree-view using pefile and PyQt5. It can also be used with IDA Pro, Ghidra, Volatility, Rekall and minidump to view and dump in-memory PE files, as well as perform import table reconstruction. Table of contents 1...

USN-8517-1 clamav vulnerabilities

It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. CVE-2026-20213, CVE-2026-20214, CVE-2026-20217 It was discovered that ClamAV incorrectly handled certain 7z archive files...

USN-8517-1: ClamAV vulnerabilities

It was discovered that ClamAV incorrectly handled certain PE files. A remote attacker could possibly use this issue to cause ClamAV to crash, resulting in a denial of service. CVE-2026-20213, CVE-2026-20214, CVE-2026-20217 It was discovered that ClamAV incorrectly handled certain 7z archive files...

CVE-2025-7004

Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus ...

CVE-2025-7018

CVE-2025-7018 is a null pointer dereference in Avira Antivirus engine when scanning malformed Windows PE files, potentially causing Denial-of-Service of the antivirus engine process. Affected product: Avira Antivirus across Windows, macOS, and Linux, with vulnerable engine builds prior to 8.3.70....

CVE-2025-7008 Avast antivirus heap buffer OOB read when scanning a malformed PE file

Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code or Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast...

CVE-2025-7008

CVE-2025-7008 describes a heap buffer out-of-bounds read in Gen Digital antivirus engines ( Avast Antivirus, AVG, Norton, Avast One/Business) when scanning malformed Windows PE files containing .NET metadata. Root cause: heap OOB read in the scanning logic when processing such PE files; impact in...

CVE-2025-7005 Avast antivirus infinite recursion when scanning a malformed PE file

Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for vir...

CVE-2025-7005 Avast antivirus infinite recursion when scanning a malformed PE file

Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This issue affects Avast Antivirus, AVG Antivirus, Norton Antivirus, Avast One, and Avast Business Antivirus on Windows, macOS, and Linux for vir...

PT-2026-49012

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions prior to VPS 25022500 AVG Antivirus versions prior to VPS 25022500 Norton Antivirus versions prior to VPS 25022500 Avast One versions prior to VPS 25022500 Avast Business Antivirus versions prior to VPS 25022500...

PT-2026-49011

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions prior to VPS 25031700 AVG Antivirus versions prior to VPS 25031700 Norton Antivirus versions prior to VPS 25031700 Avast One versions prior to VPS 25031700 Avast Business Antivirus versions prior to VPS 25031700...