Tools-and-Tuts

Helpful Tools and Tutorials regarding Binaries Research

Packers & Obfuscators

Detect It Easy

http://ntinfo.biz/index.html

Unpack Me

https://www.unpac.me/

.NET Binaries Research

De4dot - Awesome tool for unpacking and deobfuscating .NET binaries

https://github.com/de4dot/de4dot

Windows Binaries Research

Dynamic Analysis

ApateDNS - fake DNS responses

https://www.fireeye.com/content/dam/fireeye-www/services/freeware/sdl-apatedns.zip

Static Analysis

CFF Explorer

https://ntcore.com/files/ExplorerSuite.exe

Windows VM tools essentials

General:

Everything (Don’t forget to enable Regex Search)

Notepad++

JavaScript Plugin

Json Plugin

7zip

CFF Explorer

Hex editor (010 Editor, etc.)

Grep

BeyondCompare

Postman

Windows Research:

IDA (32 and 64 bit)

X64dbg

Windows Sysinternals

.NET research:

Dnspy (32 and 64 bit)

DIE (detect-it-easy)

De4dot (.NET deobjuscator)

Python research:

pyinstxtractor

Uncompyle6 + pycdc

Wireshark

Process Explorer

Send to sha256 (you can use cmd built-in tool “certutil”)

Visual Studio

ChromeCookiesView (by Nirsoft)

Yara

Proxy Tools:

Mitm proxy

Proxifier

Linux Binaries Research

Educational Articles

Intezer - ELF Malware Analysis 101 Part 2: Initial Analysis

https://www.intezer.com/blog/malware-analysis/elf-malware-analysis-101-initial-analysis/

Intezer - ELF Malware Analysis 101: Part 3 - Advanced Analysis

https://www.intezer.com/blog/malware-analysis/elf-malware-analysis-101-part-3-advanced-analysis/