~/hackyfeed $

PeNet is a C# library designed for parsing Windows Portable Executable (PE) headers without relying on native Windows APIs. Its primary use case is in malware analysis, providing features such as Import Hash generation, Certificate Revocation List extraction, and various hash computations to facilitate the analysis and manipulation of PE files.

PE Library is a modern C++ library focused on parsing and manipulating Windows Portable Executable (PE) files, supporting both PE32 and PE32+ formats. Key features include comprehensive access to PE file headers and sections, utilities for address conversions, and specific structures like import/export tables and resource directories. The library emphasizes performance and simplicity, and it includes a fuzzer that has been utilized to enhance its robustness by identifying and resolving parsing edge cases.

PacketSnitch is a network analysis tool that processes packet capture (.pcap) files, providing searchable, protocol-aware insights for security professionals and researchers. Its key features include an Electron-based frontend for interactive browsing and filtering of network traffic, GeoIP integration for location visualization, payload analysis, and support for various protocols. Additionally, it offers AI-generated summaries and a plugin engine for extended functionalities.

MWDB Core is a malware repository component designed for automated malware collection and analysis systems, facilitating the management and examination of malware binaries and their configurations. Notable features include a robust storage solution, relationship tracking and visualization between objects, a user-friendly interface for querying datasets, and integration capabilities through webhooks and plugins. The tool is aimed at enhancing the effectiveness of malware analysis by providing comprehensive data sharing and user management mechanisms.

MobileAudit is a Django web application designed for static analysis and malware detection in Android APKs. It provides a comprehensive dashboard that aggregates SAST findings, app metadata, security vulnerabilities, and malware checks, while integrating with VirusTotal and optional tools like DefectDojo. Key features include customizable SAST rules, export capabilities for scan reports, and a token-based API with user management for secure access.

Mobile Security Framework (MobSF) is a comprehensive security research platform for analyzing mobile applications across Android, iOS, and Windows Mobile ecosystems. It facilitates static and dynamic analysis, enabling use cases such as penetration testing, malware analysis, and privacy assessments, all of which can be integrated into DevSecOps workflows via REST APIs and CLI tools. Notable features include support for multiple mobile binary formats, runtime data analysis, and interactive instrumentation for comprehensive security evaluations.

Meow-meow is a repository that compiles a diverse range of cybersecurity research results, showcasing both successful and experimental practical cases. Its primary use case is to serve as a resource for cybersecurity professionals and enthusiasts seeking insights into malware development and practical applications of ethical hacking. Notable features include links to various related publications and books authored by the creator, providing additional context and depth in the field of cybersecurity.

Malware DB is a malware knowledge management system designed to catalog and manage the lifecycle of malware, benign, and unknown file samples, including their hashes, origins, and similarity metrics. Targeted at malware researchers and forensic investigators, it offers features such as sample categorization via custom taxonomies, group-based access permissions, file encryption, and advanced search capabilities based on file characteristics and Yara rules. This tool is currently in beta and emphasizes best practices for handling potentially harmful samples.

Macaron is a software supply chain security analysis tool developed by Oracle Labs, designed to verify the build integrity of software artifacts and their dependencies across various ecosystems such as PyPI and npm. Notable features include attestation verification for provenance validation, detection of malicious packages, identification of vulnerable GitHub Actions, and support for reproducible builds through static analysis of build scripts, enhancing the security and traceability of software development workflows.

LIEF is a cross-platform library designed for parsing, modifying, and abstracting executable formats such as ELF, PE, and Mach-O, along with others like COFF, OAT, and DEX. Notable features include a user-friendly API for accessing format internals, support for runtime information, debugging data, and disassembler functionality for multiple architectures. The library provides interfaces for various programming languages including C++, Python, Rust, C, and Node.js, making it highly versatile for developers in the cybersecurity domain.

Lenspect is a lightweight security threat scanner that utilizes VirusTotal to analyze potential threats. Its primary use case is to provide users with quick and efficient scans for security vulnerabilities within their systems. Notable features include support for installation via Flatpak and AppImage, providing accessibility across various Linux distributions, as well as a user-friendly interface for enhanced usability.

Lancelot is an Intel x86(-64) code analysis library designed to reconstruct control flow, facilitating detailed program analysis. It supports WebAssembly, enabling execution in browser environments, and includes a Zydis-based disassembler for enhanced disassembly capabilities. Notable features include integration with Cranelift for advanced code generation and the ability to create JavaScript bindings for easy deployment in Node.js and browser contexts.

IOC Finder is a tool designed to extract indicators of compromise (IOCs) such as URLs and email addresses from textual data. Its primary use case is enhancing threat detection and analysis by parsing relevant observables from various text sources. Notable features include interactive documentation and a focus on community support for ongoing improvements.

Hydra Dragon Antivirus is an open-source antivirus tool primarily designed for x86-64 Windows systems, focusing on real-time protection against automated threats while avoiding the overhead of heavy signature-based detection. The tool features a minimalistic approach by utilizing key components like Owlyshield and OpenEDR, emphasizing efficiency and instant threat response without interfering with legitimate user actions. It is currently in active development, intended for expert malware analysts, and anticipates future alignment with professional testing standards.

Ghidra CLI is a Rust-based command-line tool designed for automating reverse engineering tasks within the Ghidra framework. It features a direct communication bridge to Ghidra's JVM, enabling fast, in-memory queries and program analysis without the overhead of separate JVM invocations for each command. Notable functionalities include batch operations, flexible output formats, type system manipulation, and the ability to execute scripts, all of which enhance the efficiency of reverse engineering workflows.

The "Awesome Malware Analysis" repository is a curated collection of malware analysis tools and resources, aimed at facilitating comprehensive malware research and detection. It features a wide array of categories, including malware collections, detection tools, honeypots, and online scanners, providing users with diverse methodologies for malware investigation and analysis. Notable features include organization by specific use cases, such as memory forensics and deobfuscation, which enhance the accessibility of relevant resources for researchers and analysts in the cybersecurity domain.

The FLARE Obfuscated String Solver (FLOSS) is a static analysis tool designed to automatically extract and deobfuscate strings from malware binaries, enhancing the traditional `strings.exe` utility. It effectively identifies and extracts various types of obfuscated strings, including static, stack, and decoded strings, thereby improving the analysis of potential malware artifacts. Notable features include support for language-specific string formats and the ability to interface with other tools like Binary Ninja and IDA Pro through additional scripts.

Figment is a tool designed to streamline the creation of a malware analysis lab by automating the deployment of FlareVM, REMnux, and CAPE Server through a series of commands. It leverages Packer for image building and Ansible for provisioning, enabling users to set up an isolated, host-only network for capturing network traffic between different VMs. Notable features include compatibility with major hypervisors like VMware, VirtualBox, and QEMU/KVM, as well as the option to use prebuilt Vagrant boxes for rapid setup.

fast16 is a collection of IDA Pro databases and analysis artifacts specifically for the fast16 Windows malware framework, which features an embedded Lua 5.0 runtime and complex propagation mechanisms. This tool serves as a resource for researchers to verify and extend their analyses of the malware’s component interactions and behavior, offering detailed insights into its operation through reconstructed source code and a structural catalog of its rules. Notable features include the inclusion of decompiled Lua code, mappings of function calls, and a comprehensive database of the malware's execution environment.

DRAKVUF Sandbox is an automated black-box malware analysis system that operates without requiring agents on the guest operating system, utilizing the DRAKVUF engine for its core functionality. It features a user-friendly web interface for uploading and analyzing suspicious files, along with an installer that simplifies the setup process for beginners while allowing for advanced configuration by experienced users. This tool is designed to facilitate the identification of malicious files efficiently, though it requires specific hardware and software setups for optimal performance.

dotscope is a high-performance, cross-platform framework designed for analyzing, reverse engineering, and modifying .NET PE executables using Rust. Its key features include efficient memory access for parsing and modifying CIL bytecode, comprehensive metadata analysis, method injection capabilities, and a rich set of tools for static analysis and deobfuscation. The tool supports native PE operations and is built with robustness in mind, providing memory safety and extensive error handling.

DFIRWS is a digital forensics and incident response (DFIR) tool designed to operate within a Windows Sandbox environment, facilitating streamlined setup and maintenance of necessary forensics tools. Its notable features include automated downloading and updating of DFIR tools through a PowerShell script, synchronization capabilities for offline environments, and a user-friendly configuration process for sandbox setups. This tool is particularly advantageous for cybersecurity professionals seeking to perform incident response without the complexities of managing an extensive DFIR toolkit.

Defensive Security Hub is a comprehensive repository designed to support Security Operations Center (SOC) analysts by providing a curated collection of resources, tools, and references across various cybersecurity domains. Its primary use case involves enhancing the capabilities of SOC teams through structured access to training materials, threat hunting tools, DFIR methodologies, and intelligence frameworks. Notable features include a well-organized repository structure with sections on training courses, articles, blogs, and various security tools, facilitating quick navigation and resource discovery.

Capa is an advanced tool designed to analyze executable files, specifically PE, ELF, .NET modules, and shellcode, by detecting their operational capabilities. It provides detailed insights into potential functionalities, such as backdoor activities and methods of communication, while allowing interactive exploration of results via a web interface. Notable features include the ability to respond to custom rules, integration with the MITRE ATT&CK framework, and multiple output options for comprehensive analysis.

box-ps is a PowerShell sandboxing utility designed to execute PowerShell scripts in a controlled environment, mitigating security risks associated with running untrusted code. Its primary use case includes testing and analyzing scripts while allowing specific behaviors, such as file system manipulation and process management, through a defined set of properties. Notable features include detailed behavior tracking for code execution, subprocess control, and network probing, along with comprehensive error handling to address various operational issues.