kairos-t / malware-analysis-toolkit

[IN THE WORKS] Python script designed to provide comprehensive analysis of malware samples, combining static and dynamic analysis techniques to analyse the behaviour and characteristics of analysed malware. Utilises PEfile library and PyREBox (VM sandbox)

Malware-Analysis-Toolkit

The Malware Analysis Tool is a Python-based tool that performs static and dynamic analysis on Windows PE files. It leverages the capabilities of pefile and frida to extract information about the PE file structure, perform dynamic analysis using hooking techniques, and extract printable strings from the file.

Features

• Static analysis: Extracts information about the PE file structure, including image base, entry point, number of sections, and imported functions.
• Dynamic analysis: Uses frida to perform dynamic analysis by hooking function calls, memory access, and API calls, and traces execution flow using Frida's Stalker module.
• String extraction: Extracts printable strings from the PE file.

Usage

1. Clone the repository:

git clone https://github.com/Kairos-T/Malware-Analysis-Toolkit

2. Install the required packages:

pip install -r requirements.txt

3. Run the malware analysis tool:

python malware_analysis_tool.py <path_to_pe_file>

Replace <path_to_pe_file> with the path to the PE file you want to analyse.

Contributing

Contributions are welcome! If you have any suggestions or encounter any bugs, please open an issue or submit a pull request.

Acknowledgements

• pefile
• frida