Sojobo

Sojobo - 一个二进制分析框架 Sojobo 是用于 B2R2 框架的模拟器。它的创建是为了简化对潜在恶意文件的分析。它完全使用 .NET 开发，因此您无需安装或编译任何其他外部库（该项目是自包含的）。 使用 Sojobo ，您可以： 模拟一个（32位）PE二进制文件 检查模拟进程的内存 读取进程状态 显示执行代码的反汇编 以托管语言（C 或 F）模拟函数 使用 Sojobo 的工具 ADVDeobfuscator ADV Deobfuscator - 针对 ADVObfuscator 的字符串去混淆器 ADVDeobfuscator 是一个基于 Sojobo...

pridelocker-analysis

PrideLocker ESX encryptor analysis This repository contains resources related to the analysis made on PrideLocker and available on this blog post: https://www.synacktiv.com/publications/pridelocker-a-new-fork-of-babuk-esx-encryptor.html. an IDA Python script to deobfuscate strings embedded in the...

FLOSS - FireEye Labs Obfuscated String Solver (Automatically extract obfuscated strings from malware)

Rather than heavily protecting backdoors with hardcore packers, many malware authors evade heuristic detections by obfuscating only key portions of an executable. Often, these portions are strings and resources used to configure domains, files, and other artifacts of an infection. These key...