Forensic & Malware Analysis

Tools and resources for forensic and malware analysis.

198 tools in this category
Showing 198 of 198 tools
![AWS logo
From ImHex
![Build status
From sleuthkit
![Build Status
From CyLR
![Build Status
From drltrace
![Coverage Status
From mitmproxy
![JetBrains logo
From ImHex
![Latest Version
From mitmproxy
![SignPath logo
From ImHex
![Supported Python versions
From mitmproxy
[paper
From Sherloq
[paper
From Sherloq
[paper
From Sherloq
[paper
From Sherloq
[paper
From Sherloq
[paper
From Sherloq
[website
From Sherloq
@abdullah_rush
From Kuiper
@muteb_alqahtani
From Kuiper
@saleh_muhaysin
From Kuiper
010 Editor
Edit text files, XML, HTML, Unicode and UTF-8 files, C/C++ source code, PHP, etc. Unlimited undo and powerful editing and scripting tools.
Abdullah Alrasheed
From Kuiper
Add Custom Parser
From Kuiper
Alan Orlikoski
From CyLR
Android Malware Sandbox
Sandbox for analyzing Android malware.
Any Run
Interactive malware sandbox for real-time analysis and threat intelligence.
Autopsy
Digital forensics platform and graphical interface for The Sleuth Kit and other tools.
AxCut
From ImHex
Belkasoft Evidence Center
Comprehensive digital forensics and incident response platform.
Binalyze AIR
Digital forensics platform for comprehensive incident response.
Block search view
From dynStruct
Bluepot
Bluetooth honeypot for monitoring and capturing malicious activity.
Bookmarks, data information, find view and data processor
From ImHex
Bottle
From dynStruct
BruteXSS
Finds Cross-Site Scripting (XSS) vulnerabilities in web applications.
build 7.91.18109
From dynStruct
build status
From drltrace
CAINE
Ubuntu-based tool that provides a complete forensic environment with a graphical interface.
CAPE
Malware sandbox designed for executing and analyzing malicious files.
CFR
Java decompiler supporting features up to Java 14.
changes
From REKALL
Charles Proxy
A cross-platform GUI web debugging proxy for viewing intercepted HTTP and HTTPS/SSL live traffic.
Conda environment
From Sherloq
cronbuild
From dynStruct
Cuckoo Sandbox
Automated malware analysis and detection in an isolated environment.
Cyber Triage
Automated DFIR software for investigating malware, ransomware, and account takeovers.
Dalfox
Powerful open-source XSS scanner for automation.
Data Information view displaying various stats about the file
From ImHex
Data Processor decrypting some data and displaying it as an image
From ImHex
Dear ImGui
From ImHex
DFIRKuiperAPI
From Kuiper
DFTimewolf
Framework for orchestrating forensic collection, processing, and export.
directory
From drltrace
Distribute
Malware analysis tool that helps distribute files for analysis.
docker image
From Kuiper
Dumpzilla
Tool to extract forensic data from Firefox, Iceweasel, and Seamonkey browsers.
Dwarf Debugger
A debugger for reverse engineers and security analysts.
DynamoRIO
From dynStruct
DynamoRIO
From drltrace
EaseUS
Free Data Recovery Software Recover up to 2GB data for free on Windows 11/10/8/7
edit member view
From dynStruct
edlib
From ImHex
Elastic Security YARA Rules
Signature-based YARA rules for detecting threats across multiple platforms.
EnCase
Suite of digital investigation products by Guidance Software.
Eric's Registry Explorer/RECmd
From RegRipper4.0
evtkit
Tool for fixing acquired Windows Event Log files.
Example disassembly
From dynStruct
Executing Commands and Bypassing AppLocker with PowerShell Diagnostic Scripts
Demonstrates techniques for bypassing AppLocker and executing commands with PowerShell diagnostic scripts.
Fabric Platform
Automates cybersecurity reporting with open-source tools and templates.
Findom-XSS
A simple DOM-based XSS vulnerability scanner.
Findsploit
Instantly find exploits from local and online databases.
First screenshot
From dynStruct
GetFieldsScript
From Kuiper
github.com/dazinator/DotNet.Glob
From CyLR
GitHunter
Searches Git repositories for sensitive data.
GRR
From REKALL
Gscript Dropper
Introduction to using Gscript as a dropper tool in red team operations.
HashLibPlus
From ImHex
Hex editor, patterns and data information
From ImHex
Hoarder
Tool for collecting and parsing Windows artifacts for digital forensics.
Hoarder
From Kuiper
HxD
A hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size
Hybrid-Analysis
Provides in-depth static and dynamic analysis of files.
Hybrid-Analysis
Hybrid Analysis is a Malaware analysis service it's free and has ai or someone does it for free it's reliable and more accurate than total virus.
ImGuiColorTextEdit
From ImHex
ImHex Plugin Template
From ImHex
ImNodes
From ImHex
ImPlot
From ImHex
Inlyse
AI-based IT security platform for identifying and stopping advanced malware.
IPED - Indexador e Processador de Evidências Digitais
Brazilian Federal Police forensic investigation tool.
IPED Digital Forensic Tool
Open-source tool for analyzing disk images and file systems.
iTrooz
From ImHex
Jason Yegge
From CyLR
json
From ImHex
jumanji144
From ImHex
jwt-key-id-injector
Python script to test for JWT vulnerabilities.
KAPE
From Kuiper
Klara
Distributed Python system to help hunt for new malware using Yara rules.
libevt
Library for parsing Windows Event Logs for forensic analysis.
libfmt
From ImHex
libregf
Library for accessing and parsing Windows NT Registry files.
licenses directory
From sleuthkit
Log2Timeline (Plaso)
Tool for creating timelines for forensic analysis.
ltrace
From drltrace
Mailaender
From ImHex
Malheur
Tool for automatic analysis of malware behavior using machine learning.
MalShare
Platform for uploading, searching, and downloading malware samples.
Malware Traffic Analysis
Analyzes malicious network traffic to detect malware activity.
Malwover
Malware detection and prevention for advanced cyber threats.
malzilla
Malware hunting tool for analysis and detection.
Mary
From ImHex
Master Thesis
From dynStruct
Mastiff
Static analysis framework for extracting key characteristics from files.
microtar
From ImHex
miniaudio
From ImHex
Mobile Audit
SAST and malware analysis tool for Android APKs.
Mobile Verification Toolkit (MVT)
Forensic tool for gathering traces from Android and iOS devices.
Muteb Alqahtani
From Kuiper
nativefiledialog-extended
From ImHex
Neal Krawetz
From Sherloq
NodeYara
Yara module for Node.js for scanning with Yara rules.
Odin
Malware analysis platform with advanced threat detection.
official site
From Sherloq
Open Letter to the users of Skadi, CyLR, and CDQR
From CyLR
OSDFCON 2017
From CyLR
Pancake Viewer
DFVFS-backed viewer for file extraction and viewing.
PhotoRec
PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks (Mechanical Hard drives, Solid State Drives...), CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory.
Publication
From dynStruct
PyaraScanner
Multithreaded YARA scanner for incident response or malware zoos.
PyLibEmu
Python wrapper for Libemu for shellcode analysis.
Python
From REKALL
qsfuzz
Fuzzes query strings to identify security vulnerabilities.
Radare2
Powerful framework for reverse engineering and binary analysis.
ReClass
A reverse engineering tool for Windows executable analysis.
Recuva
Recover your deleted files quickly and easily. Accidentally deleted an important file? Lost files after a computer crash? No problem - Recuva recovers files from your Windows computer, recycle bin, digital camera card, or MP3 player!
Redline
Host investigation and data acquisition tool.
ReFlutter
Framework for reverse engineering Flutter apps.
RegRipper - Handling transaction logs
From RegRipper4.0
Rekall-Forensic.com
From REKALL
releases
From Forensic Tools
Research on CMSTP.exe
Detailed research on using CMSTP.exe for bypassing security restrictions and executing arbitrary code.
Roblabla
From ImHex
Saleh Muhaysin
From Kuiper
Sandboxie-Plus
Another Malaware sandbox and might be a better option if your testing runs.
Shotgunyara
Generates YARA rules for various string and encoded malware variations.
Silk Guardian
Anti-forensic Linux kernel module that acts as a USB port kill-switch.
Skadi
Open-source tools for forensic artifact and image analysis.
Static File Analyzer (SFA)
A deep analysis tool for malicious files using ClamAV and YARA rules.
STL Parser written in the Pattern Language visualizing a 3D model
From ImHex
StringSifter
A machine learning tool for ranking strings for malware analysis.
tcpdump
A powerful command-line packet analyzer, along with libpcap for network traffic capture.
TestDisk
Data recovery software for recovering lost partitions and undeleting files.
the Database
From ImHex
The DFIR Report
In-depth threat intelligence reports and services.
The Sleuth Kit
From sleuthkit
this guide
From Sherloq
tools/fstools
From sleuthkit
Triton
Dynamic binary analysis library with emulation capabilities.
Turbinia
Framework for automating forensic processing in cloud environments.
UHstudent
From Sherloq
UploadMachines
From Kuiper
usbmon
USB capture tool for Linux, used for monitoring USB traffic.
USBPcap
USB capture tool for Windows, useful for monitoring USB traffic.
Vaya-Ciego-Nen
Tool to detect and exploit Blind XSS vulnerabilities.
VirtualEnvWrapper
From Sherloq
Volatility
Framework for memory forensics and analysis of volatile memory.
Volatility 3
Framework for extracting data from volatile memory for system state analysis.
VxSig
Automatically generates AV byte signatures for similar binaries.
warp packer
From CyLR
Weaponised-XSS-payloads
A collection of XSS payloads for exploiting web vulnerabilities.
WerWolv
From ImHex
wiki
From sleuthkit
wiki
From drltrace
Wiki page
From drltrace
wiki/fat
From sleuthkit
wiki/filesystem
From sleuthkit
wiki/hfind
From sleuthkit
wiki/mactime
From sleuthkit
wiki/ntfs
From sleuthkit
wiki/sorter
From sleuthkit
Windows oneliners to download remote payload and execute arbitrary code
Explains one-liner PowerShell commands for downloading and executing malicious payloads.
WinHex
Universal hex editor for forensics, data recovery, and IT security tasks.
WinHex
A hexadecimal editor, helpful in the realm of computer forensics, data recovery, low-level data processing, and IT security
Wiz
Cloud-native security platform for detecting and preventing security threats.
WSH Injection: A Case Study
A case study on exploiting Windows Script Host (WSH) injection for command execution.
xdgpp
From ImHex
XSSCon
A simple XSS scanner for detecting vulnerabilities.
XSSor
A tool for exploiting and testing XSS vulnerabilities in web apps.
xssor2
Tool for testing and exploiting XSS vulnerabilities.
Yabin
Creates Yara signatures from malware to identify similar samples.
Yara
From ImHex
YARA
From REKALL
Yara Decompressor
Tool to decompress malware samples for running YARA rules.
Yara Rule Generator
A tool for creating YARA rules quickly to isolate malware families.
Yara Station
Management portal for LoKi scanner with a centralized database.
Yara-Rust
Yara bindings for Rust supporting various features like rule compilation.
YARA-Signator
Automatically generates YARA rules for malware repositories.
YaraStation
Management portal for Yara rule-based malware scanning.
yarGen
Generates YARA rules by extracting strings from malware files.