Malware Analysis

DShield dockerShell

A Docker container running the Cowrie SSH honeypot with DShield reporting to contribute to internet threat intelligence.

Writing a simple PE packer in detailC++

A detailed guide and implementation for a simple PE file packer that encrypts executable sections and adds an unpacking stub.

FFRI Dataset ScriptsPython

Scripts to create malware analysis datasets in the same format as the FFRI Dataset, extracting features from executable files.

detectionYARA

A collection of open-source threat detection rules for Snort, Sigma, and Yara security tools.

Packer detection tool evaluationPython

Evaluates packer detection tools pypeid and Detect It Easy (DIE) on malware datasets to compare accuracy and false positive rates.

gomalshareGo

Go client library for interacting with the MalShare malware repository API.

go-emulatorsGo

A collection of honeypot service emulators written in Go for improved security and performance.

PackIDC++

A multiplatform packer identification tool and library using PEiD-compatible database syntax.

PE-ToyAssembly

A PE file packer that adds a custom shell to executable files for protection and modification.

OllyDbg ScriptsBatchfile

A collection of OllyDbg scripts for unpacking various software packers and protectors.

Simple-PE32-PackerC++

A simple PE32 executable packer using aPLib compression library for Windows.

PyPeidPython

A Python implementation of PEiD for detecting packers, compilers, and anti-debugging techniques in Windows PE files using YARA rules.

node-ftp-honeypotJavaScript

A Node.js FTP honeypot that captures malicious file uploads from bots and scanners.

DolosHoneypotCSS

A software-defined networking honeypot that captures and analyzes malicious traffic by simulating vulnerable network services.

PANDIJupyter Notebook

A dynamic packing detection solution for malware analysis built on the PANDA platform.

Generic File ParserPython

A Python library for malware file analysis that extracts metadata, performs static analysis, and detects macros across multiple file formats.

REMINDerPython

Detects packers in executable files using an entropy-based heuristic from academic research.

Malware OrganiserPython

A Python tool that organizes malware and benign files into a structured database with tagging and querying capabilities.

Yara FinderPython

A simple web tool to scan files against YARA rules for detecting suspicious indicators.