malpedia-flossed

Malpedia FLOSSed 此仓库包含对 Malpedia 中所有解包并转储的样本应用 FLARE FLOSS 工具 的结果，经过预处理以供进一步使用。 我们计划定期更新此集合。 在2026年1月的最近一次运行中，处理了与2,136个恶意软件家族相关的9,202个文件。 FLOSSing 产生了61,135,522个原始字符串，经过清洗和去重，缩减至5,666,515个唯一字符串。 解压后，该集合当前大小约为1300 MB。 数据格式 字符串集合以 JSON 字典形式提供（见文件夹 data），包含三个部分： about：类似文件头，包含关于此集合的一些元数据。...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer 版本: 0.4 Bytes Revealer 是一款功能强大的逆向工程和二进制分析工具，专为安全研究人员、取证分析人员和开发者设计。它提供十六进制视图、可视化表示、字符串提取、熵计算和文件签名检测等功能，帮助用户发现文件中隐藏的数据。无论是分析恶意软件、调试二进制文件，还是调查未知文件格式，Bytes Revealer 都能让您轻松浏览、搜索和提取任何二进制文件中的有价值信息。 Bytes Revealer...

proctools

proctools 用于从 Windows 进程中提取信息并转储敏感字符串的小工具包。配合 FormThief 使用。 procsearch - 在目标进程内存中查找敏感字符串 在可读的进程内存中搜索已解析的字符串，若找到，则显示搜索字符串周围一定范围内的有效 ASCII 字符 procinfo - 显示进程可执行文件的以下文件版本信息： 进程名称 描述 产品名称 文件版本 内部名称 公司名称 注释 法律版权 法律商标 产品版本 私有构建 特殊构建 procargs - 提取目标进程的命令行参数 prockill - 终止目标进程 procsearch.cpp...

hardcodes

hardcodes 从源代码中提取字符串 hardcodes 是一款用于搜索开发者在程序中硬编码的字符串的工具。它使用模块化分词器，能够处理注释、任意数量的反斜杠以及几乎所有你能扔给它的语法。 是的，它旨在处理任何语法，并且官方支持以下语言： ada, applescript, c, c, c++, coldfusion, golang, haskell, html, java, javascript, jsp, lua, pascal, perl, php, powershell, python, ruby, scala, sql, swift, xml 安装 使用 pip pip3...

CVE-2024-1346

CVE-2024-1346 LaborOfficeFree 中弱 MySQL 数据库 root 密码影响版本 19.10。此漏洞允许攻击者使用两个常量计算 LaborOfficeFree 所用 MySQL 数据库的 root 密码。 Exploit Title: LaborOfficeFree 19.10 MySQL Root Password Calculator - CVE-2024-1346 Google Dork: N/A Date: 09/02/2023 Exploit Author: Peter Gabaldon - https://pgj11.com/ Vendor...

CVE-2026-30873 OpenWrt Project jsonpath: Memory leak when processing strings, labels, and regexp tokens

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jpgettoken function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field...

PT-2026-26382

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp get token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field...

Happy IR in the New Year!

At the end of last year Mr. Jake Williams from aka @MalwareJake asked a very important question about Lack of visibility during detecting APT intrusions in twitter. Results show us that endpoint analysis is the most important part of any research connected with APTs. Also, for sure endpoint...

Professional PE file Explorer: PPEE

Professional PE file Explorer Puppy is a lightweight yet strong tool for static investigation of suspicious files. A companion plugin is also provided to query the file in the well-known malware repositories and take one-click technical information about the file such as its size, entropy,...

Automated Memory Analyzer For Malware Samples: VolatilityBot

Automated Memory Analyzer For Malware Samples VolatilityBot is an automation tool for researchers cuts all the guesswork and manual tasks out of the binary extraction phase, or to help the investigator in the first steps of performing a memory analysis investigation. Not only does it automaticall...

PE Static Malware Analysis: PortEx

PortEx is a Java library for static malware analysis of portable executable files. Its focus is on PE malformation robustness and anomaly detection. PortEx is written in Java and Scala, and targeted at Java applications. Features Reading Header information from: MSDOS Header, COFF File Header,...