hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

pesieve-go

pesieve-go Golang bindings for PE-sieve. Requires pe-sieve32.dll, pe-sieve64.dll of a supported version to be present in the project directory, or in a path pointed by the environment variable: PESIEVEDIR. API Exposes the following wrappers for PE-sieve API: PESieveVersion uint32 func PESieveHelp...

pe-sieve

Introducción PE-sieve es una herramienta que ayuda a detectar malware en ejecución en el sistema, así como a recolectar el material potencialmente malicioso para su posterior análisis. Reconoce y vuelca una variedad de implantes dentro del proceso escaneado: PE reemplazados/inyectados, shellcodes...

mal_unpack

malunpack Unpacker dinamico basato su PE-sieve 📖 Leggi altro . Distribuisce un malware packed, attende che questo esegua l'unpack del payload, esegue il dump del payload e termina il processo originale. !CAUTION Questo unpacker distribuisce il malware originale. Usalo solo su una macchina virtual...

ida_ifl

IFL - Elenco interattivo delle funzioni Licenza: CC-BY https://creativecommons.org/licenses/by/3.0/ Un piccolo plugin con l'obiettivo di fornire un modo intuitivo per navigare tra le funzioni e i loro riferimenti. Inoltre, consente di importare report generati ad esempio da PE-sieve in IDA...

Investigate Inline Hooks: PE-sieve

PE-sieve is a light-weight tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory...