Hot answers tagged


For learning purposes, I would recommend you the following Github projects to start with: Paranoid Fish by a0rtega Al-Khaser v0.60 by Noteworthy or Colection by AlicanAkyol Grab one you like, compile and analyze. In case you look for in ...


In addition to the other useful links here, I recommend to try Malware-Jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript (Windows Scripting Host) context env/wscript.js, at least the part frequently used by ...


I want to know how to test malware files with out using virtual environment. Check out the answers in the following, similar, question: Analysing malware in a real environment (non-virtual environment) TL;DR: Check out Faronics Depp Freeze for example. I recommend reading the answers as a whole. In addition, read the answers to the following question on ...


The following call stack can be found in MrmCoreR.dll: Microsoft::Resources::MetroAppClientProfile::IsUnsafeLoadPriFileAllowed Microsoft::Resources::HasCapability RtlCheckSandboxedToken Seems like it's used by Metro applications to know if they were run in the sandbox. And RtlCheckSandboxedToken() checks the token if it can be accessed via some specific ...


Use KVM. Most of the time malwares will try to detect VMWare and Virtualbox based artifacts.


If you are analyzing ELF binaries, then the open source online sandbox detux may prove useful: Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so. Detux logs network data including IP addresses the program sends signals to, DNS queries, URLs accessed and TCP raw streams: If you are performing ...

1 is old but it is good tool. is current. You can use it.


For the last year I've been developing box-js, and I found it to be the most accurate tool when analyzing JScript droppers. Internally, it uses UglifyJS2 to run a static analysis and simplify many obfuscation techniques; the rest is achieved through emulation in a V8 sandbox.

Only top voted, non community-wiki answers of a minimum length are eligible