mirror of
https://github.com/lockfale/OSINT-Framework.git
synced 2026-08-21 13:22:24 +02:00
Merge pull request #649 from lockfale/feature/THE-166-malicious-file-analysis-enrichment
Enrich Malicious File Analysis tool metadata (THE-166)
This commit is contained in:
s0lray
+512
-32
@@ -17945,32 +17945,122 @@
|
||||
{
|
||||
"name": "Decalage Malware Search",
|
||||
"type": "url",
|
||||
"url": "https://decalage.info/en/mwsearch"
|
||||
"url": "https://decalage.info/en/mwsearch",
|
||||
"description": "Custom metasearch engine that indexes malware analysis databases to find malware samples containing specific strings, filenames, hashes, or IOCs.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick metasearch across multiple malware analysis databases by hash, string, or filename",
|
||||
"input": "IOC (hash, filename, string, yara rule, VT hash)",
|
||||
"output": "Links to malware analysis reports from aggregated databases",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Search-only interface; no account required; queries are directed to indexed databases",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "VirusShare.com",
|
||||
"type": "url",
|
||||
"url": "https://virusshare.com/"
|
||||
"url": "https://virusshare.com/",
|
||||
"description": "Repository of 111+ million live malware samples provided for security researchers, incident responders, forensic analysts, and researchers.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Bulk access to malware sample collections for research and analysis",
|
||||
"input": "MD5 hash, account credentials",
|
||||
"output": "Malware sample files (zip archives, password protected), related IOCs",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Registration required; no direct execution occurs; passive hash lookup available",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "#totalhash",
|
||||
"type": "url",
|
||||
"url": "https://totalhash.cymru.com/"
|
||||
"url": "https://totalhash.cymru.com/",
|
||||
"description": "Malware Hash Registry that searches against 30+ antivirus databases to validate malware hashes with detection percentage results. Updated daily.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Hash validation against 30+ AV engines with detection percentages",
|
||||
"input": "MD5 or SHA-1 hash",
|
||||
"output": "Detection percentage, last seen timestamp, signature matches from AV databases",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "No registration required; read-only hash lookups leave minimal traces",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "VX Vault",
|
||||
"type": "url",
|
||||
"url": "https://vxvault.net/ViriList.php"
|
||||
"url": "https://vxvault.net/ViriList.php",
|
||||
"description": "Active collection of malware samples and related data shared among security researchers and malware analysts for threat intelligence.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Access to active malware sample collections",
|
||||
"input": "Web interface browsing, malware sample queries",
|
||||
"output": "Malware sample information, related indicators",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Web-based browsing interface; no registration typically required",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "ID Ransomware",
|
||||
"type": "url",
|
||||
"url": "https://id-ransomware.malwarehunterteam.com/"
|
||||
"url": "https://id-ransomware.malwarehunterteam.com/",
|
||||
"description": "Free ransomware identification tool that analyzes ransom notes and encrypted file samples to identify variants and provide decryption guidance. Detects 1181+ ransomware types.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Ransomware identification and victim support",
|
||||
"input": "Ransom note file, encrypted file sample, ransom email address",
|
||||
"output": "Ransomware variant identification, decryption status, victim resources",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "File uploads provide victim privacy options to protect personal data exposure",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "National Software Reference Library",
|
||||
"type": "url",
|
||||
"url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php"
|
||||
"url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php",
|
||||
"description": "NIST-maintained repository of cryptographic hash values for known, legitimate software to identify known-good files during digital forensics investigations.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Eliminating known-good files in forensic investigations and digital triage",
|
||||
"input": "File hash (MD5, SHA-1, SHA-256), software query",
|
||||
"output": "Hash matches to known software, file metadata, product versioning",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "No registration required; lookup-only service; government maintained",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -17985,12 +18075,42 @@
|
||||
{
|
||||
"name": "TYLabs QuickSand Framework",
|
||||
"type": "url",
|
||||
"url": "https://scan.tylabs.com/"
|
||||
"url": "https://scan.tylabs.com/",
|
||||
"description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Document and PDF malware analysis with exploit detection",
|
||||
"input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript",
|
||||
"output": "YARA signature matches, exploit detection, risk scoring, threat analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Hosted analysis requires file upload; local installation available for offline use",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "JoeSandbox Document Analyzer",
|
||||
"type": "url",
|
||||
"url": "https://www.joesandbox.com/"
|
||||
"url": "https://www.joesandbox.com/",
|
||||
"description": "Hosted automated malware analysis service that performs dynamic and static analysis of files including Office documents, PDFs, and executables with comprehensive behavioral reporting.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Comprehensive malware analysis with behavioral insights and threat scoring",
|
||||
"input": "Executable files, documents, PDFs, URLs, APKs (Max 30MB free tier)",
|
||||
"output": "Behavioral analysis, network IOCs, detection verdicts, MITRE ATT&CK mappings, export formats (JSON, XML, HTML, PDF)",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads are processed on external sandbox; free tier limited to 30 submissions/month",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18001,7 +18121,22 @@
|
||||
{
|
||||
"name": "TYLabs QuickSand Framework",
|
||||
"type": "url",
|
||||
"url": "https://scan.tylabs.com/"
|
||||
"url": "https://scan.tylabs.com/",
|
||||
"description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Document and PDF malware analysis with exploit detection",
|
||||
"input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript",
|
||||
"output": "YARA signature matches, exploit detection, risk scoring, threat analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Hosted analysis requires file upload; local installation available for offline use",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18012,12 +18147,42 @@
|
||||
{
|
||||
"name": "Akana Android Malware",
|
||||
"type": "url",
|
||||
"url": "https://akana.mobiseclab.org/"
|
||||
"url": "https://akana.mobiseclab.org/",
|
||||
"description": "Online Android Interactive Analysis Environment with plugins for analyzing malicious Android applications and APKs for suspicious behavior and malware characteristics.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Android app malware analysis and interactive examination",
|
||||
"input": "Android APK files",
|
||||
"output": "Malware detection results, behavioral analysis, plugin-based threat assessment",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads required; external analysis service",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Joe APK Analyzer",
|
||||
"type": "url",
|
||||
"url": "https://www.apk-analyzer.net/"
|
||||
"url": "https://www.apk-analyzer.net/",
|
||||
"description": "Part of Joe Sandbox suite; performs dynamic and static analysis of Android Application Packages to detect malicious behavior and generate detailed analysis reports.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Android malware analysis with dynamic behavior monitoring",
|
||||
"input": "Android APK files",
|
||||
"output": "Malware detection, behavioral analysis, threat intelligence IOCs",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads to external sandbox; free tier has limitations",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18044,67 +18209,262 @@
|
||||
{
|
||||
"name": "OPSWAT Meta Defender",
|
||||
"type": "url",
|
||||
"url": "https://metadefender.opswat.com/#!/"
|
||||
"url": "https://metadefender.opswat.com/#!/",
|
||||
"description": "Multi-engine malware scanning service using 20+ antivirus engines with advanced threat analysis, content disarm & reconstruction, and emulation-based detection for zero-day threats.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Multi-engine malware detection with advanced threat analysis",
|
||||
"input": "Files (all types), URLs",
|
||||
"output": "Multi-engine scan results, threat verdicts, IOC extraction, file behavior analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads required; free community version available with API limits",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Hybrid Analysis",
|
||||
"type": "url",
|
||||
"url": "https://hybrid-analysis.com/"
|
||||
"url": "https://hybrid-analysis.com/",
|
||||
"description": "Free automated malware analysis service powered by CrowdStrike Falcon Sandbox. Combines runtime data with memory dump analysis to extract execution pathways and IOCs for evasive malware.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Advanced malware behavior analysis and evasion detection",
|
||||
"input": "Files (30MB max free tier), URLs, APKs (up to 30 per month free)",
|
||||
"output": "Hybrid behavioral analysis, memory dumps, disassembly, IOC extraction, behavioral indicators",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Free tier limited to 30 uploads/month; file uploads to external sandbox infrastructure",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Malware Config",
|
||||
"type": "url",
|
||||
"url": "https://malwareconfig.com/"
|
||||
"url": "https://malwareconfig.com/",
|
||||
"description": "Database for searching and analyzing extracted malware configurations by hash, domain, or IP address to track C2 infrastructure and malware attributes.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Malware configuration extraction and C2 server tracking",
|
||||
"input": "SHA256 hash, domain, IP address, malware family",
|
||||
"output": "Extracted malware configurations, C2 infrastructure, encrypted keys, command data",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Search-only interface; no file uploads required; passive lookups",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": true,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "MetaDefender",
|
||||
"type": "url",
|
||||
"url": "https://metadefender.opswat.com/"
|
||||
"url": "https://metadefender.opswat.com/",
|
||||
"description": "OPSWAT's cloud-based multi-engine malware scanning platform with advanced threat detection using 30+ antivirus engines, CDR technology, and behavioral analysis.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Enterprise-grade multi-engine malware detection and advanced threat analysis",
|
||||
"input": "Files, URLs, streams",
|
||||
"output": "Multi-engine detection results, threat verdicts, behavioral analysis, IOC extraction",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads required; commercial and free tiers available",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Ether",
|
||||
"type": "url",
|
||||
"url": "https://ether.gtisc.gatech.edu/web_unpack/"
|
||||
"url": "https://ether.gtisc.gatech.edu/web_unpack/",
|
||||
"description": "Georgia Tech malware analysis framework using Intel VT hardware virtualization for transparent, stealthy malware analysis resistant to anti-analysis techniques.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Transparent malware analysis resistant to anti-analysis evasion",
|
||||
"input": "Executable files, malware samples",
|
||||
"output": "Fine-grained execution traces, instruction-level analysis, unpacking results, behavior extraction",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Hosted analysis service; academic research project from Georgia Institute of Technology",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Jotti's Malware Scanner",
|
||||
"type": "url",
|
||||
"url": "https://virusscan.jotti.org/en-US/scan-file"
|
||||
"url": "https://virusscan.jotti.org/en-US/scan-file",
|
||||
"description": "Free multi-scanner malware analysis service that submits files for analysis against 14+ antivirus engines. No installation or account setup required.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Quick multi-engine scan without installation or account setup",
|
||||
"input": "Files (up to 5 concurrent, 250MB per file)",
|
||||
"output": "Detection results from 14+ AV engines, file metadata, scan reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "No account required; file uploads to external scanning service",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Valkyrie File Analysis",
|
||||
"type": "url",
|
||||
"url": "https://consumer.valkyrie.comodo.com/"
|
||||
"url": "https://consumer.valkyrie.comodo.com/",
|
||||
"description": "Cloud-based verdict-driven malware analysis platform from Comodo using static analysis (450+ unpackers), dynamic analysis, and optional human expert analysis for unknown files.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Advanced malware analysis with human expert review option",
|
||||
"input": "Files (all types), URLs",
|
||||
"output": "File verdict, behavioral analysis results, IOC extraction, confidence scores, expert analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads required; expert analysis available for premium users",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "detux Linux Sandbox",
|
||||
"type": "url",
|
||||
"url": "https://detux.org/"
|
||||
"url": "https://detux.org/",
|
||||
"description": "Open-source multiplatform Linux sandbox for analyzing Linux malware across multiple CPU architectures (x86, x86-64, ARM, MIPS) using QEMU emulation and traffic analysis.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Linux malware analysis across multiple architectures",
|
||||
"input": "Linux executable files, malware samples",
|
||||
"output": "Static analysis strings, dynamic traffic capture, IOC extraction, architecture-specific analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Open-source tool; can be deployed locally or used as hosted service",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Joe File Analyzer",
|
||||
"type": "url",
|
||||
"url": "https://www.file-analyzer.net/"
|
||||
"url": "https://www.file-analyzer.net/",
|
||||
"description": "Part of Joe Sandbox suite; performs hybrid code analysis of PE files on Windows with detailed behavioral and system interaction reporting.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "PE file malware analysis with system interaction tracking",
|
||||
"input": "PE executable files (.exe, .dll, etc.)",
|
||||
"output": "Hybrid behavioral analysis, system calls, network IOCs, threat scores",
|
||||
"opsec": "active",
|
||||
"opsecNote": "File uploads to Joe Sandbox infrastructure; free tier has submission limits",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Pikker.ee Cuckoo Sandbox",
|
||||
"type": "url",
|
||||
"url": "https://sandbox.pikker.ee/"
|
||||
"url": "https://sandbox.pikker.ee/",
|
||||
"description": "Public instance of Cuckoo Sandbox malware analysis system hosted in Estonia. Provides automated dynamic analysis with detailed result reporting for submitted files.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Free automated dynamic malware analysis with detailed behavioral reports",
|
||||
"input": "Executable files, documents, archives",
|
||||
"output": "Process monitoring, API calls, file system changes, network traffic, behavioral analysis",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Public instance; files uploaded to external infrastructure; Estonian-hosted",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Koodous",
|
||||
"type": "url",
|
||||
"url": "https://koodous.com"
|
||||
"url": "https://koodous.com",
|
||||
"description": "Collaborative platform for Android malware research and analysis with community-driven database of 70+ million Android applications with crowd-sourced malware detection.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Android malware analysis with community collaboration and threat intelligence",
|
||||
"input": "Android APK files, package names, hashes",
|
||||
"output": "Malware detection results, community analysis, threat indicators, sample sharing",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Registration available; community platform with shared threat intelligence",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Any Run",
|
||||
"type": "url",
|
||||
"url": "https://app.any.run/"
|
||||
"url": "https://app.any.run/",
|
||||
"description": "Interactive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report generation with MITRE ATT&CK mapping.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Interactive malware analysis with real-time system interaction",
|
||||
"input": "Files, URLs, APKs, documents (platform-specific)",
|
||||
"output": "Process graphs, behavioral analysis, MITRE ATT&CK TTPs, IOCs, customizable reports",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Interactive analysis leaves traces; free tier limited to 3 public analyses/day; private mode in paid plans",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Uncover It",
|
||||
"type": "url",
|
||||
"url": "https://www.uncoverit.org/"
|
||||
"url": "https://www.uncoverit.org/",
|
||||
"description": "Static malware configuration extractor that quickly analyzes files without execution to extract malware configurations, C2 infrastructure, and IOCs in under 5 seconds.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Fast static malware configuration extraction",
|
||||
"input": "Malware samples, executable files",
|
||||
"output": "Extracted configurations, C2 servers, encryption keys, behavioral indicators",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Static analysis only; no code execution; quick analysis without external dependencies",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18115,12 +18475,42 @@
|
||||
{
|
||||
"name": "Office Mal Scanner (T)",
|
||||
"type": "url",
|
||||
"url": "https://www.reconstructer.org/"
|
||||
"url": "https://www.reconstructer.org/",
|
||||
"description": "Malicious Office document analysis tool for analyzing and reconstructing Office documents to identify exploits and malicious content.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Malicious Office document analysis and reconstruction",
|
||||
"input": "Microsoft Office documents (.doc, .xls, .ppt)",
|
||||
"output": "Document structure analysis, malicious content extraction, exploit identification",
|
||||
"opsec": "active",
|
||||
"opsecNote": "Document upload required; analysis service online",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "OffVis (T)",
|
||||
"type": "url",
|
||||
"url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip"
|
||||
"url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip",
|
||||
"description": "Microsoft Office Visualization Tool for analyzing Office binary files to identify exploits and malicious structures. Displays hex and object tree views.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Office binary file format analysis and exploit detection",
|
||||
"input": "Office binary files (.doc, .xls, .ppt, .pps, .pot)",
|
||||
"output": "File structure visualization, hex dump, object trees, vulnerability detection",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local desktop application; no file uploads; Microsoft-provided tool",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18131,12 +18521,42 @@
|
||||
{
|
||||
"name": "PDF Tools (T)",
|
||||
"type": "url",
|
||||
"url": "https://blog.didierstevens.com/programs/pdf-tools/"
|
||||
"url": "https://blog.didierstevens.com/programs/pdf-tools/",
|
||||
"description": "Free suite of PDF analysis tools by Didier Stevens including pdfid (keyword scanning) and pdf-parser.py for analyzing malicious PDF documents and extracting embedded objects.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "PDF structure analysis and malicious object extraction",
|
||||
"input": "PDF files",
|
||||
"output": "PDF keyword identification, object parsing, embedded JavaScript detection, IOC extraction",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Command-line tools; local execution; open-source from reputable security researcher",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Origami Framework (T)",
|
||||
"type": "url",
|
||||
"url": "https://code.google.com/archive/p/origami-pdf/"
|
||||
"url": "https://code.google.com/archive/p/origami-pdf/",
|
||||
"description": "Ruby framework for parsing, analyzing, and forging PDF documents. Includes PDF Walker GUI and PDFcop heuristic checker for detecting dangerous PDF content.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "PDF parsing and manipulation for malicious PDF analysis",
|
||||
"input": "PDF files, PDF objects, malicious content",
|
||||
"output": "Parsed PDF structure, extracted objects, deobfuscated content, modified PDFs",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Open-source framework; local installation required; no file uploads",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
@@ -18147,24 +18567,84 @@
|
||||
{
|
||||
"name": "Malware-Traffic-Analysis.net",
|
||||
"type": "url",
|
||||
"url": "https://www.malware-traffic-analysis.net/index.html"
|
||||
"url": "https://www.malware-traffic-analysis.net/index.html",
|
||||
"description": "Training resource and PCAP repository providing network traffic captures from malware infections since 2013. Includes tutorials and exercises for malware traffic analysis.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Malware network behavior analysis and training exercises",
|
||||
"input": "PCAP files, network traffic captures",
|
||||
"output": "Network indicators (IPs, domains, C2 servers), behavioral analysis, post-exploitation patterns",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "PCAP analysis is passive; no live malware execution; educational resource",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "Ghidra (T)",
|
||||
"type": "url",
|
||||
"url": "https://github.com/NationalSecurityAgency/ghidra"
|
||||
"url": "https://github.com/NationalSecurityAgency/ghidra",
|
||||
"description": "Free and open-source reverse engineering framework from NSA for analyzing compiled software. Includes disassembly, decompilation, scripting, and interactive graphing for malware analysis.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Reverse engineering and static malware analysis",
|
||||
"input": "Executable files (ELF, PE, Mach-O, raw binaries), multiple architectures",
|
||||
"output": "Disassembly, decompiled code, control flow graphs, function analysis, custom scripts",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Local desktop application; no file uploads; open-source from NSA",
|
||||
"localInstall": true,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "Malware Analysis Tools",
|
||||
"type": "url",
|
||||
"url": "https://malwareanalysis.tools/"
|
||||
"url": "https://malwareanalysis.tools/",
|
||||
"description": "Curated resource and reference guide for malware analysis tools with recommendations for virtualization, safety practices, and tool selection for analysis scenarios.",
|
||||
"status": "live",
|
||||
"pricing": "free",
|
||||
"bestFor": "Malware analysis tool discovery and best practices reference",
|
||||
"input": "Tool research, methodology guidance",
|
||||
"output": "Tool recommendations, analysis methodologies, safety practices, learning resources",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "Reference resource only; no file uploads or active analysis",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": false,
|
||||
"editUrl": false,
|
||||
"api": false,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
},
|
||||
{
|
||||
"name": "virustotal",
|
||||
"type": "url",
|
||||
"url": "https://www.virustotal.com/gui/home/upload"
|
||||
"url": "https://www.virustotal.com/gui/home/upload",
|
||||
"description": "Free online service that analyzes files and URLs for viruses, trojans and malicious content detected by 70+ antivirus engines and URL/domain reputation services.",
|
||||
"status": "live",
|
||||
"pricing": "freemium",
|
||||
"bestFor": "Multi-engine malware scanning and URL reputation lookup",
|
||||
"input": "Files, URLs, domains, IP addresses, file hashes",
|
||||
"output": "Detection results from 70+ AV engines, behavioral analysis, file insights, related samples",
|
||||
"opsec": "passive",
|
||||
"opsecNote": "File uploads are indexed and visible to other users; hash-only queries are private",
|
||||
"localInstall": false,
|
||||
"googleDork": false,
|
||||
"registration": true,
|
||||
"editUrl": false,
|
||||
"api": true,
|
||||
"invitationOnly": false,
|
||||
"deprecated": false
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
Reference in New Issue
Block a user