A collaborative malware analysis framework for storing samples, automating analysis, and sharing insights via IDA Pro integration.
Polichombr is a collaborative malware analysis framework that helps security teams store, analyze, and share insights on malicious software. It automates parts of the analysis process by identifying points of interest in binaries and integrates with tools like IDA Pro for real-time collaboration. The framework supports signature-based detection using Yara and MACHOC hashing to classify and track malware families.
Security analysts, malware researchers, and incident response teams who need to collaboratively analyze and document malicious software in a shared environment.
Developers choose Polichombr for its strong focus on collaboration, seamless IDA Pro integration, and automation features that streamline malware analysis workflows, reducing duplication of effort and improving team efficiency.
Collaborative malware analysis framework
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The Skelenox IDAPython plugin synchronizes names, comments, and analysis data across users in real-time, enabling seamless collaboration directly within IDA Pro.
Uses a ruby script (AnalyzeIt) to identify crypto loops and sensitive API calls, providing analysts with guided starting points for manual investigation.
Supports multiple signature types including Yara, imphash, and the MACHOC CFG-based hash for robust malware classification and family tracking.
Offers a web-based platform for sample storage, documentation, and online disassembly, allowing teams to access and share analysis from anywhere.
Installation requires consulting separate documentation and managing dependencies, which can be time-consuming compared to plug-and-play solutions.
Core collaboration features like Skelenox are tied to IDA Pro, excluding users of other disassemblers and creating vendor lock-in for teams.
Primarily focuses on static analysis hints; lacks built-in dynamic analysis, sandboxing, or advanced automated reporting found in broader frameworks.