[Killtrojan Syslog] Tool to detect malware activity on a system

Killtrojan Syslog is a free application to create a report about characteristics of the system to further analyze and look for signs of malware, also is intended to put the report in a specialized forum for users to help.

The tool has a very intuitive and easy to use for non-technical users to create their reports. Also useful for more advanced users who want to analyze a computer.

With the support logs with BBCode mode, you can paste the log generated in any forum (SMF, PHPBB, Invision ...) which will be detailed with clear colors for your reading.

Download Killtrojan Syslog

[Pinpoint] Enumerates WebPage Components to help identify the Infected Files

Pinpoint works like wget/curl in that it just fetches a webpage without rendering any script. Pinpoint will then try to determine which links are used to make up the webpage such as Javascript, CSS, frames, and iframes and downloads those files too (some Javascript content will produce incorrect links). The list of links it finds shows up in the document tree on the main window.

At the same time, a log file is created which shows the links and in which file the link resided in. It will also download the file and calculate the “entropy”; the higher the value, the more rubbish characters it found which may help identify obfuscated Javascript.

You can of course spoof the user-agent string and referer values to ilicit a malicious response from the website. There’s also a function to clear your cookies (see Options menu item) since many exploit packs check for the presence of cookies on repeated visits. Use Tor to get another IP address since it’ll get banned usually after the first visit.

Download Pinpoint

[RDG Packer Detector 2014] Detector de Packers,Cryptors,Compiladores, Packers Scrambler,Joiners,Installers

RDG Packer Detector es un detector de packers,Cryptors,Compiladores, Packers Scrambler,Joiners,Installers.

+Nuevas signaturas+Windows 7 Compatible
+Windows 8 Compatible
+Menos Falsos Positivos
+Mayor Estabilidad
+Deteccion 32/64 bits PE

-Posee sistema de detección Rápida.
-Posee sistema de detección Potente Analizando el archivo completo, permitiendo la muli-detección de packers en varios casos.
-Permite crear signaturas tus propias signaturas de detección.
-Posee Analizador Crypto-Grafico.
-Permite calcular el checksum de un archivo.
-Permite calcular el Entropy, informando si el programa analizado esta comprimido, encriptado o no.
-Detector de OEP (Punto de entrada Original) de un programa.
-Puedes Chequear y descargar signaturas.Así siempre tú RDG Packer Detector estará Actualizado.
-Loader de Plug-ins..
-Convertidor de Signaturas.
-Detector de Falseadores de Entry Point.
-De-Binder un extractor de archivos adjuntos.
-Sistema Heuristico Mejorado.

Descargar RDG Packer Detector

[Malheur v0.5.4] Malware Analyzer

Malheur is a tool for the automatic analysis of malware behavior (program behavior recorded from malicious software in a sandbox environment). It has been designed to support the regular analysis of malicious software and the development of detection and defense measures. Malheur allows for identifying novel classes of malware with similar behavior and assigning unknown malware to discovered classes.

Analysis of malware behavior?

Malheur builds on the concept of dynamic analysis: Malware binaries are collected in the wild and executed in a sandbox, where their behavior is monitored during run-time. The execution of each malware binary results in a report of recorded behavior. Malheur analyzes these reports for discovery and discrimination of malware classes using machine learning.

Malheur can be applied to recorded behavior of various format, as long as monitored events are separated by delimiter symbols, for example as in reports generated by the popular malware sandboxes CWSandbox, Anubis, Norman Sandbox and Joebox

.

Download Malheur

[Comodo Instant Malware Analysis] Online Automated Analysis System

If you have a suspicious file, please submit it online by using the form below. Once the file is submitted, COMODO Automated Analysis System will scan it and report back its findings.

Comodo Instant Malware Analysis

[Anubis] Online Analyzing Unknown Binaries

Anubis is a service for analyzing malware.

Submit your Windows executable or Android APK and receive an analysis report telling you what it does. Alternatively, submit a suspicious URL and receive a report that shows you all the activities of the Internet Explorer process when visiting this URL. 

Anubis

[Malware Classifier] Malware Analysis Tool

Adobe Malware Classifier is a command-line tool that lets antivirus analysts, IT administrators, and security researchers quickly and easily determine if a binary file contains malware, so they can develop malware detection signatures faster, reducing the time in which users' systems are vulnerable.

Malware Classifier uses machine learning algorithms to classify Win32 binaries – EXEs and DLLs – into three classes: 0 for “clean,” 1 for “malicious,” or “UNKNOWN.”

The tool was developed using models resultant from running the J48, J48 Graft, PART, and Ridor machine-learning algorithms on a dataset of approximately 100,000 malicious programs and 16,000 clean programs. 

The tool extracts seven key features from an unknown binary, feeds them to one of the four classifiers or all of them, and presents its classification of the unknown binary.

Download Malware Classifier

[VirusTotal] Online Malware Analysis Tool

VirusTotal, a subsidiary of Google, is a free online service that analyzes files and URLs enabling the identification of viruses, worms, trojans and other kinds of malicious content detected by antivirus engines and website scanners. At the same time, it may be used as a means to detect false positives, i.e. innocuous resources detected as malicious by one or more scanners.

VirusTotal’s mission is to help in improving the antivirus and security industry and make the internet a safer place through the development of free tools and services.

VirusTotal

[Hook Analyser 3.0] A Freeware Malware Analysis and Cyber Threat Intelligence Software

In terms of improvements, a new module has been added - Cyber Threat Intelligence. Threat Intel module is being created to gather and analyse information related to Cyber Threats and vulnerabilities.

The module can be run using HookAnalyser.exe (via Option 6 ), or can be run directly.

The module present information on a web browser (with dashboard alike representation) with the following sections -

1. Threat Vectors - by (%) Country
2. Threat Vectors - by Geography 
3. Vulnerability / Threat Feed.

Project documentation - Click Here

Here is the screenshot of the Cyber Threat Intelligence dashboard -

Download Hook Analyser 3.0

[Hook Analyser v2.6] Application (and Malware) Analysis tool

Application (and Malware) Analysis tool. Hook Analyser is a hook tool which could be potentially helpful in reversing application and analysing malwares.

Changelog v2.6

• Added new signatures (and removed redundant ones)
• Bug fixes – Many thanks for community users to reporting them.
• Fixed start-up error.

More Information:

• http://hookanalyser.blogspot.com

Download Hook Analyser v2.6

[Malcom] Malware Communication Analyzer

Malcom is a tool designed to analyze a system's network communication using graphical representations of network traffic. This comes handy when analyzing how certain malware species try to communicate with the outside world.

Malcom can help you:

• detect central command and control (C&C) servers
• understand peer-to-peer networks
• observe DNS fast-flux infrastructures
• quickly determine if a network artifact is 'known-bad'

The aim of Malcom is to make malware analysis and intel gathering faster by providing a human-readable version of network traffic originating from a given host or network. Convert network traffic information to actionable intelligence faster.

Check the wiki for a Quickstart and some nice screenshots.

In the near future, it will also become a collaborative tool (coming soon!)

Download Malcom

[Pyew v2.2] A Python tool for static malware analysis

Pyew is a (command line) python tool to analyse malware. It does have support for hexadecimal viewing, disassembly (Intel 16, 32 and 64 bits), PE and ELF file formats (it performs code analysis and let you write scripts using an API to perform many types of analysis), follows direct call/jmp instructions in the interactive command line, displays function names and string data references; supports OLE2 format, PDF format and more. It also supports plugins to add more features to the tool.

Pyew have been successfully used in big malware analysis systems since almost 2 years, processing thousand of files daily.

See some usage examples, example batch scripts or a tool to compare and group programs (PE and ELF) using the API provided by Pyew.

NOTE: It's highly recommended to always use the Mercurial version instead of the versions available in the Downloads section.

ChangeLog:

Version 2.2 Stable (12-30-2012)

• Loads of bug fixes.
• Many little enhancements to the x86 code analysis engine, notoriously increasing the overall speed and finding more functions and basic blocks missed in previous versions.
• Updated PEFile version to 1.2.10.
• Support for 2 more disassembly engines: diStorm v3 and pymsasid (pure python disassembler).
• Automatic calculation of the application call graph and function's flow graphs.
• Support for analysing x86 boot sector files.

Version 2.1 Beta (11-27-2011)

• Added Kenshoto's VTrace.
• Initial support for integrated debugging.
• Good support for ELF file format (both 32 and 64 bits).
• Code analysis engine enhanced.
• Fixed a lot of bugs.

Version 2.0

• Code analysis system for x86 rewritten from scratch.
• Support for databases. You can analyze binaries (PE or ELF) and save/open databases.
• Added graph's based clusterization tool 'gcluster.py'.
• Added new PDF utilities:
• pdfss: Seek to one stream
• pdfobj: Show object's list
• pdfso: Seek to one object
• Added new plugins:
• binvi: Show an image representing the contents of the file. Usefull to see different sections in a binary.
• packer: Check if the PE file is packed
• cgraph: Show the callgraph of the whole program (needs PyGTK to show a GUI).
• Many bug fixes.

Version 1.1.1

• Support for ELF file formats (AMD64 and IA32) using the Kenshoto's ELF library (VTrace).
• Code analysis by recursively traversing all possible code paths from entry points.
• Added the following APIS:
• resolveName: Resolves the internal name of the given address/offset.
• NextHead: Return the next disassembly offset given an address/offset.
• GetMnem/GetMnems: Returns the mnemonic or mnemonic list given an offset and the number of mnemonics to retrieve.

Pyew is very similar in some aspects to the following tools:

• The Interactive Disassembler (IDA). Although Pyew does not compete with IDA (and the author of the tool doesn't want it at all), it can be considered as a "mini IDA" focused on batch malware analysis.
• The almighty radare.
• The open source Biew and the commercial Hiew. 

Download Pyew v2.2

[MISP v2.1] Malware Information Sharing Platform

The problem that we experienced in the past was the difficulty to exchange information about (targeted) malwares and attacks within a group of trusted partners, or a bilateral agreement. Even today much of the information exchange happens in unstructured reports where you have to copy-paste the information in your own text-files that you then have to parse to export to (N)IDS and systems like log-searches, etc…

A huge challenge in the Cyber Security domain is the information sharing inside and between organizations. This platform has as goal to facilitate:

• central IOC database: storing technical and non-technical information about malwares and attacks, … Data from external instances is also imported into your local instance
• correlation: automatically creating relations between malwares, events and attributes
• storing data in a structured format (allowing automated use of the database for various purposes)
• export: generating IDS, OpenIOC, plain text, xml output to integrate with other systems (network IDS, host IDS, custom tools, …)
• import: batch-import, import from OpenIOC, GFI sandbox, ThreatConnect CSV, …
• data-sharing: automatically exchange and synchronization with other parties and trust-groups

Exchanging info results in faster detection of targeted attacks and improves the detection ratio while reducing the false positives. We also avoid reversing similar malware as we know very fast that others already worked on this malware.

Download MISP v2.1

[PyMal] The Malware Analysis Framework

PyMal is a python based interactive Malware Analysis Framework. It is built on the top of three pure python programes Pefile, Pydbg and Volatility.

The main aim of the project is to combine all the Malware Analysis related tools into a single interface for rapid analysis.

PyMal have several wrapper functions to manipulate Executable as well as running Processes. It also offers some advanced features like

• Injected Code Detection
• Hook Detection using Passive Image Referencing
  

For detailed view of the features and working, please check out the demonstration video shown below.

It works on all platforms starting from Windows XP to Windows 8.

Download PyMal v1.0