API Monitor is a free software that lets you monitor and control API calls made by applications and services. It's a powerful tool for seeing how applications and services work or for tracking down problems that you have in your own applications.

capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

Examples:

capa.exe suspicious.exe -vv
capa 05be49819139a3fdcdbddbdefd298398779521f3d68daa25275cc77508e42310.json

CSSC is a shellcode encoder and disassembler with a graphical interface, built on Keystone and Capstone.

DIE is a cross-platform application; apart from the Windows version there are also versions available for Linux and macOS.

The FLARE Obfuscated String Solver (FLOSS, formerly FireEye Labs Obfuscated String Solver) uses advanced static analysis techniques to automatically extract and deobfuscate all strings from malware binaries.

Examples:

floss malware.exe
floss --only stack tight -- suspicious.exe

Ghidra is a software reverse engineering framework, including a disassembler and a decompiler for a wide range of processor architectures.

ILSpy is the open-source .NET assembly browser and decompiler.

JD-GUI is a standalone graphical utility that displays Java source code from .class files, letting you browse reconstructed source and navigate methods and fields.

Loki is an IOC scanner. It matches on file names, hashes and YARA rules, and is useful for a quick triage sweep of a suspect host.

The mal_unpack deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. This unpacker deploys the original malware. Use it only on a Virtual Machine.

Examples:

mal_unpack.exe /exe malware.exe /timeout 2000

PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

The goal of pestudio is to spot artifacts of executable files in order to ease and accelerate Malware Initial Assessment.

PPEE (puppy) is a Professional PE file Explorer for reversers, malware researchers and those who want to statically inspect PE files in more details.

pyinstxtractor extracts the contents of a PyInstaller-generated executable, recovering the bundled .pyc files for further decompilation.

Examples:

pyinstxtractor test.exe

radare2 provides a set of libraries, tools and plugins to ease reverse engineering tasks.

Examples:

$ r2 /bin/ls   # open file in read-only
> aaa          # analyse the program (r2 -A)
> afl          # list all functions (try aflt, aflm)
> px 32        # print 32 byte hexdump current block
> s sym.main   # seek to main (using flag name)
> f~foo        # filter flags matching 'foo' (internal |grep)
> iS;is        # list sections and symbols (rabin2 -Ss)
> pdf; agf     # disassembly and ascii-art function graph
> oo+;w hello  # reopen in read-write and write a string
> ?*~...       # interactive filter in all command help
> q            # quit

scdbg is a shellcode analysis application built around the libemu emulation library. When run it will display to the user all of the Windows API the shellcode attempts to call.

UPX is a free, secure, portable, extendable, high-performance executable packer for several executable formats.

Examples:

upx -o packed_file.exe original_file.exe
upx -d packed_file.exe

VT is the official VirusTotal command line client. It queries files, hashes, URLs, domains and IP addresses against VirusTotal and can download samples and search Intelligence.

Examples:

vt file 8ac1f5f6ba2ee9b0ba4b1a4bb1e2b6d1
vt url https://example.com
vt search 'type:peexe size:100kb+ positives:5+'

x64dbg is an open-source x64/x32 debugger for windows.

Xvolkolak is an unpacker emulator. Unlike programs of this type, it does not use DebugAPI and other features of the operating system.

BrowsingHistoryView is a utility that reads the history data of different Web browsers (Mozilla Firefox, Google Chrome, Internet Explorer, Microsoft Edge, Opera) and displays the browsing history of all these Web browsers in one table. The browsing history table includes the following information: Visited URL, Title, Visit Time, Visit Count, Web browser and User Profile. BrowsingHistoryView allows you to watch the browsing history of all user profiles in a running system, as well as to get the browsing history from external hard drive.

ChromeCacheView is a small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache. For each cache file, the following information is displayed: URL, Content type, File size, Last accessed time, Expiration time, Server name, Server response, and more.

ChromeCookiesView is an alternative to the standard internal cookies viewer of Google Chrome Web browser. It displays the list of all cookies stored by Google Chrome Web browser, and allows you to easily delete unwanted cookies. It also allows you export the cookies into text/csv/html/xml file.

Hindsight parses Chromium-based browser profiles and produces a single timeline of history, downloads, cookies, cache metadata, autofill, local storage and preferences.

MZCacheView reads the cache folder of Mozilla Firefox and displays the list of files currently stored there.

SafariCacheView reads the Cache.db file of the Safari browser and displays the list of files stored in the cache, along with their URLs and metadata.

bulk_extractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input (disk images, files, directories of files, etc) and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets without parsing the file system or file system structures. The results are stored in text files that are easily inspected, searched, or used as inputs for other forensic processing. bulk_extractor also creates histograms of certain kinds of features that it finds, such as Google search terms and email addresses, as previous research has shown that such histograms are especially useful in investigative and law enforcement applications.

Examples:

bulk_extractor -o bulk-out image.img

Foremost-NG is a file recovery tool that extracts files from disk images or devices by scanning for configurable file headers and footers. It supports common forensic formats (e.g., .dd, Safeback, Encase) and can operate on both image files and live devices.

Examples:

foremost-ng -i disk.img -o /temp/output/carved
foremost-ng -t evtx,elf,exe -i disk.img -o /temp/output/carved
foremost-ng -x -t elf -i memory.dump -o ./carved-files

OSFMount allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the physical disk name (eg. \\.\PhysicalDrive1) or logical drive letter (eg. Z:). By default, the image files are mounted as read only so that the original image files are not altered.

PhotoRec is file data recovery software designed to recover lost files including video, documents and archives from hard disks (Mechanical Hard drives, Solid State Drives...), CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media's file system has been severely damaged or reformatted.

TestDisk is powerful free data recovery software! It was primarily designed to help recover lost partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software: certain types of viruses or human error (such as accidentally deleting a Partition Table). Partition table recovery using TestDisk is really easy.

The Sleuth Kit® is a collection of command line tools and a C library that allows you to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools.

Examples:

fsstat -i raw evidence.dd
fls -i raw evidence.dd
istat -f ext4 -i raw evidence.dd
mmls evidence.dd
fsstat evidence.dd
img_stat evidence.dd

$I Parse is a tool for parsing $I (index) files from the Recycle Bin of Windows Vista and later.

AmCache-EvilHunter is a command-line tool to parse and analyze Windows Amcache.hve registry hives, identify evidence of execution, suspicious executables, and integrate VirusTotal/OpenTIP lookups for enhanced threat intelligence.

Examples:

amcache_evilhunter.exe -i Amcache.hve
amcache_evilhunter.exe -i Amcache.hve --start 2021-01-01 --end 2021-12-31 --search notepad
amcache_evilhunter.exe -i Amcache.hve --find-suspicious -v
amcache_evilhunter.exe -i Amcache.hve -v --only-detections --json detections.json

AmcacheParser is an Amcache.hve parser with lots of extra features. Handles locked files.

Examples:

AmcacheParser.exe -f "C:\Temp\amcache\AmcacheWin10.hve" --csv C:\temp
AmcacheParser.exe -f "C:\Temp\amcache\AmcacheWin10.hve" -i on --csv C:\temp --csvf foo.csv
AmcacheParser.exe -f "C:\Temp\amcache\AmcacheWin10.hve" -w "c:\temp\whitelist.txt" --csv C:\temp

APT-Hunter is a Threat Hunting tool for windows event logs which was made with a purple team mindset to detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity. APT-Hunter uses pre-defined detection rules and focuses on statistics to uncover abnormalities which is very effective in compromise assessment.

Examples:

APT-Hunter.exe -p /opt/wineventlogs/ -o Project1 -allreport
APT-Hunter.exe -hunt "psexec" -p /opt/wineventlogs/ -o Project2
APT-Hunter.exe -huntfile "(psexec|psexesvc)" -p /opt/wineventlogs/ -o Project2
APT-Hunter.exe -sigma -rules rules.json -p /opt/wineventlogs/ -o Project2

BMC-Tools is an RDP Bitmap Cache parser.

Chainsaw provides a powerful ‘first-response’ capability to quickly identify threats within Windows forensic artefacts such as Event Logs and the MFT file. Chainsaw offers a generic and fast method of searching through event logs for keywords, and by identifying threats using built-in support for Sigma detection rules, and via custom Chainsaw detection rules.

Examples:

chainsaw hunt EVTX-ATTACK-SAMPLES/ -s sigma/ --mapping mappings/sigma-event-logs-all.yml
chainsaw search mimikatz -i evtx_attack_samples/
chainsaw search -t 'Event.System.EventID: =4104' evtx_attack_samples/
chainsaw search -e "DC[0-9].insecurebank.local" evtx_attack_samples --json

EvtxECmd is an event log (evtx) parser with standardized CSV, XML, and json output! Custom maps, locked file support, and more!

Examples:

EvtxECmd.exe -f "C:\Temp\Application.evtx" --csv "c:\temp\out" --csvf MyOutputFile.csv
EvtxECmd.exe -f "C:\Temp\Application.evtx" --csv "c:\temp\out"
EvtxECmd.exe -f "C:\Temp\Application.evtx" --json "c:\temp\jsonout"

Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool created by the Yamato Security group in Japan.

Examples:

hayabusa.exe search -d ../hayabusa-sample-evtx -k "mimikatz"
hayabusa.exe search -d ../hayabusa-sample-evtx -r "(?:[0-9]{1,3}\.){3}[0-9]{1,3}"
hayabusa.exe search -d ../hayabusa-sample-evtx -r ".*" -F WorkstationName:"kali"

JLECmd is a Jump List parser.

Examples:

JLECmd.exe -f "C:\Temp\f01b4d95cf55d32a.customDestinations-ms" --mp
JLECmd.exe -f "C:\Temp\f01b4d95cf55d32a.automaticDestinations-ms" --json "D:\jsonOutput" --jsonpretty
JLECmd.exe -d "C:\CustomDestinations" --csv "c:\temp" --html "c:\temp" -q
JLECmd.exe -d "C:\Users\e\AppData\Roaming\Microsoft\Windows\Recent" --dt "ddd yyyy MM dd HH:mm:ss.fff"

JumpListExplorer is a GUI based Jump List viewer.

LastActivityView is a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer. The activity displayed by LastActivityView includes: Running .exe file, Opening open/save dialog-box, Opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash, network connection/disconnection and more.

LECmd is a tool for parsing lnk files.

Examples:

LECmd.exe -f "C:\Temp\foobar.lnk"
LECmd.exe -f "C:\Temp\somelink.lnk" --json "D:\jsonOutput" --pretty
LECmd.exe -d "C:\Temp" --csv "c:\temp" --html c:\temp --xml c:\temp\xml -q
LECmd.exe -f "C:\Temp\some other link.lnk" --nid --neb
LECmd.exe -d "C:\Temp" --all

LogFileParser is a parser for the $LogFile artifact on NTFS.

MFTECmd is a $MFT, $Boot, $J, $SDS, $I30, and $LogFile parser. Handles locked files.

Examples:

MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out" --csvf MyOutputFile.csv
MFTECmd.exe -f "C:\Temp\SomeMFT" --csv "c:\temp\out"
MFTECmd.exe -f "C:\Temp\SomeMFT" --json "c:\temp\jsonout"
MFTECmd.exe -f "C:\Temp\SomeMFT" --body "c:\temp\bout" --bdl c
MFTECmd.exe -f "C:\Temp\SomeMFT" --de 5-5

MFTExplorer is a graphical $MFT viewer.

PECmd is a Prefetch parser.

Examples:

PECmd.exe -f "C:\Temp\CALC.EXE-3FBEF7FD.pf"
PECmd.exe -f "C:\Temp\CALC.EXE-3FBEF7FD.pf" --json "D:\jsonOutput" --jsonpretty
PECmd.exe -d "C:\Temp" -k "system32, fonts"
PECmd.exe -d "C:\Temp" --csv "c:\temp" --csvf foo.csv --json c:\temp\json
PECmd.exe -d "C:\Windows\Prefetch"

SumECmd processes Microsoft User Access Logs.

Examples:

SumECmd.exe -d "C:\Temp\sum" --csv "C:\Temp\"

PyWMIPersistenceFinder parses OBJECTS.DATA to find WMI persistence.

Examples:

PyWMIPersistenceFinder.exe OBJECTS.DATA

RdpCacheStitcher reassembles RDP bitmap cache tiles into larger images, making it far easier to interpret what was visible during a remote desktop session. It works on the output of a cache parser such as BMC-Tools.

RecentFileCache parser.

Examples:

RecentFileCacheParser.exe -f "C:\Temp\RecentFileCache.bcf" --csv "c:\temp"
RecentFileCacheParser.exe -f "C:\Temp\RecentFileCache.bcf" --json "D:\jsonOutput" --jsonpretty

RECmd is a powerful command line Registry tool with searching, multi-hive support, plugins, and more.

Examples:

RECmd.exe --f "C:\Temp\UsrClass 1.dat" --sk URL --recover false --nl
RECmd.exe --f "D:\temp\UsrClass 1.dat" --StartDate "11/13/2014 15:35:01"
RECmd.exe --f "D:\temp\UsrClass 1.dat" --RegEx --sv "(App|Display)Name"

RBCmd is a Recycle Bin artifact (INFO2/$I) parser.

Examples:

RBCmd.exe -f "C:\Temp\INFO2"
RBCmd.exe -f "C:\Temp\$I3VPA17" --csv "D:\csvOutput"
RBCmd.exe -d "C:\Temp" --csv "c:\temp"

Registry Explorer is a registry viewer with searching, multi-hive support, plugins, and more. Handles locked files.

RegReport produces a readable report of the contents of Windows registry hives, grouping well-known keys into categories such as installed software, autostart entries and hardware.

Regshot takes a snapshot of the registry and the file system, and compares it with a second snapshot taken later. It is the standard way to see exactly what a sample changed during dynamic analysis.

SBECmd is a command line edition for exporting shellbag data.

Examples:

SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout
SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout --tz "US Eastern Standard Time"
SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout --dedupe

SDBExplorer is a Shim database GUI tool.

ShellBagsExplorer is a GUI for browsing shellbags data. Handles locked files.

AppCompatCacheParser is an AppCompatCache aka ShimCache parser.

Examples:

AppCompatCacheParser.exe --csv c:\temp -t -c 2
AppCompatCacheParser.exe --csv c:\temp --csvf results.csv

SrumECmd is a SRUM parser.

Examples:

SrumECmd.exe -f "C:\Temp\SRUDB.dat" -r "C:\Temp\SOFTWARE" --csv "C:\Temp\"
SrumECmd.exe -f "C:\Temp\SRUDB.dat" --csv "c:\temp"
SrumECmd.exe -d "C:\Temp" --csv "c:\temp"

SRUM-DUMP extracts data from the System Resource Utilization Management (SRUM) database and generates an Excel spreadsheet.

Thumbcache Viewer allows you to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files found on Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, and Windows 11.

Triager is a DFIR automation and investigation platform for Windows triage collections. It ingests a collection, runs parsers across the artifacts, and presents the results through a command line interface and a web console.

uareport is a command-line tool to parse UserAssist artifacts from Windows registry hives (NTUSER.DAT).

Examples:

uareport.exe -d evidences/Users --csv output.csv
uareport.exe -d /path/to/evidence/Users --user bob --csv bob_userassist.csv

WxTCmd is a parser for the Windows 10 Timeline feature database.

Examples:

WxTCmd.exe -f "C:\Users\eric\AppData\Local\ConnectedDevicesPlatform\L.eric\ActivitiesCache.db" --csv c:\temp

WFA decodes and analyzes some special files used by Windows OS.

WinPrefetchView is a small utility that reads the Prefetch files stored in your system and displays the information stored in them. By looking in these files, you can learn which files every application is using, and which files are loaded on Windows boot.

DSStoreParser parses .DS_Store files, which record Finder folder settings and can show that a folder or file existed on a system even after deletion.

Examples:

DSStoreParser.exe -s /path/to/mount -o output

FSEParserV4 parses macOS File System Events (FSEvents) records, producing a timeline of file system activity from the .fseventsd store.

Examples:

FSEParserV4.exe -s /path/to/fseventsd -o output

mac_apt is a macOS and iOS forensic artifact parsing tool. It processes full disk images (or live machines) and extract data/metadata useful for forensic investigation.

spotlight_parser reads and extracts data from spotlight databases present on macOS and iOS.

Examples:

spotlight_parser.exe store.db output

unifiedlog_iterator is a simple Rust library that can help parse the macOS Unified Log files.

ALEAPP is the Android Logs Events And Protobuf Parser. It processes an Android extraction and produces an HTML report covering a wide range of application and system artifacts.

Android Debug Bridge is a versatile command line tool that lets you communicate with an Android device. It supports device actions such as installing and debugging apps, shell access and file transfer.

Examples:

adb devices
adb shell
adb pull /sdcard/DCIM ./DCIM
adb backup -all -f backup.ab

ApkStudio is an open-source, cross-platform IDE for reverse engineering Android APK files. It decompiles, edits and rebuilds APKs with a graphical interface over apktool.

iLEAPP processes an iOS extraction and produces an HTML report covering a wide range of application and system artifacts.

JADX produces Java source code from Android Dex and APK files. The GUI version lets you browse decompiled code, search across it and follow references.

scrcpy displays and controls an Android device connected over USB or TCP/IP.

Examples:

scrcpy
scrcpy --record file.mp4
scrcpy --no-control

Simple batch script for getting MD5, SHA-1, and SHA-256 hashes.

Examples:

GetHashes file.exe

HashCalc is a free calculator to compute multiple hashes, checksums and HMACs for files, text and hex strings.

Hasher is a utility to calculate hashes for files.

HxD is a carefully designed and fast hex editor which, additionally to raw disk editing and modifying of main memory (RAM), handles files of any size.

ImHex is a hex editor for reverse engineers.

MailView is a utility for viewing Outlook Express, Windows Mail/Windows Live Mail and Mozilla Thunderbird message databases as well as single EML files.

MXRay is a graphical e-mail forensics tool. It parses several mailbox and message formats, analyses headers for signs of spoofing, triages attachments, and can enrich findings with VirusTotal lookups.

CobaltStrikeScan scans Windows process memory for evidence of DLL injection (classic or reflective injection) and/or performs a YARA scan on the target process' memory for Cobalt Strike v3 and v4 beacon signatures.

Examples:

CobaltStrikeScan.exe -p -d

MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

Examples:

memprocfs.exe -device c:\temp\win10x64-dump.raw
memprocfs.exe -device c:\temp\win10x64-dump.raw -forensic 1 -forensic-yara-rules c:\yara\rules\windows_malware_index.yar
memprocfs.exe -device unknown-x64-dump.raw -pagefile0 pagefile.sys -pagefile1 swapfile.sys

Vol3 is the Volatility 3 memory forensics framework. It extracts processes, network connections, injected code, registry hives and much more from a memory image.

Examples:

vol3 -f memory.raw windows.info
vol3 -f memory.raw windows.pslist
vol3 -f memory.raw windows.malfind
vol3 -f memory.raw windows.netscan

Volatility Workbench is a free open source tool that provides a graphic user interface for the Volatility memory analysis forensics tool.

FakeNet is a dynamic network analysis tool that simulates a network so malware running in a sandbox believes it is connected to the internet. It intercepts and logs the traffic, and can respond to common protocols.

nc is a simple utility that reads and writes data across TCP or UDP network connections. It is designed to be a reliable back-end tool to use directly or easily drive by other programs and scripts. At the same time, it is a feature-rich network debugging and exploration tool, since it can create almost any kind of connection you would need, including port binding to accept incoming connections.

Examples:

nc -z -v 10.10.10.10 20-80 # simple port scan
nc -lvp 8080 # listen on port 8080

NetworkMiner is an open source network forensics tool that extracts artifacts, such as files, images, emails and passwords, from captured network traffic in PCAP files. NetworkMiner can also be used to capture live network traffic by sniffing a network interface. Detailed information about each IP address in the analyzed network traffic is aggregated to a network host inventory, which can be used for passive asset discovery as well as to get an overview of which devices are communicating.

Wireshark is the world’s foremost network protocol analyser. It lets you see what is happening on the network at a microscopic level, with deep inspection of hundreds of protocols and powerful display filters. Live capture requires Npcap, which is installed alongside it.

Hash Suite is a Windows program to test security of password hashes.

hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and macOS, and has facilities to help enable distributed password cracking.

Examples:

hashcat -m 0 -a 0 hash.txt wordlist.txt
hashcat -m 1000 ntlmhash.txt -a 0 rockyou.txt

Ophcrack is a Windows Password cracker based on Rainbow Tables.

7-Zip is a file archiver with a high compression ratio.

Examples:

7z x protected.zip
7z a myzip ./MyFolder/*

bstrings is an advanced strings search program.

Examples:

bstrings.exe -f "C:\Temp\UsrClass 1.dat" --ls URL
bstrings.exe -f "C:\Temp\someFile.txt" --lr guid
bstrings.exe -f "C:\Temp\aBigFile.bin" --fs c:\temp\searchStrings.txt --fr c:\temp\searchRegex.txt -s
bstrings.exe -d "C:\Temp" --mask "*.dll"
bstrings.exe -d "C:\Temp" --ar "[\x20-\x37]"
bstrings.exe -d "C:\Temp" --cp 10007
bstrings.exe -d "C:\Temp" --ls test
bstrings.exe -f "C:\Temp\someOtherFile.txt" --lr cc --sa
bstrings.exe -f "C:\Temp\someOtherFile.txt" --lr cc --sa -m 15 -x 22
bstrings.exe -f "C:\Temp\UsrClass 1.dat" --ls mui --sl

BusyBox is a software suite that provides several Unix utilities in a single executable file.

Examples:

busybox.exe sh
busybox.exe sha1sum file.exe
busybox grep test myfile.txt

CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps, compression and decompression of data, calculating hashes and checksums, IPv6 and X.509 parsing, changing character encodings, and much more.

DB Browser for SQLite is a high quality, visual, open source tool designed for people who want to create, search, and edit SQLite or SQLCipher database files.

dd command reads one block of input, processes it and writes it into an output file.

Examples:

dd if=\\.\Volume{c18588c0-02e9-11d8-853f-00902758442b} of=c:\temp\usb1.img bs=1M
dd if=\\?\Device\Harddisk1\Partition0 of=c:\temp\usb2.img bs=1M --size --progress

Dev-C++ is a full-featured C and C++ integrated development environment. The bundled MinGW-w64 toolchain (gcc, g++, gdb and the binutils) is also placed on the PATH.

Examples:

gcc -o test.exe test.c
g++ -O2 -o test.exe test.cpp
gdb test.exe

exiftool is a command-line application and Perl library for reading and writing EXIF, GPS, IPTC, XMP, makernotes and other meta information in image, audio and video.

Examples:

exiftool image.jpg

Firefox is a free and open-source web browser, included so that HTML reports and locally saved pages can be reviewed without relying on the system browser.

Java (Temurin JDK 21) is the Eclipse Temurin build of OpenJDK. Several tools in this toolkit are Java applications and require it; JAVA_HOME is set automatically and java is placed on the PATH.

Examples:

java -version
java -jar tool.jar

NASM is the Netwide Assembler, an assembler and disassembler for the x86 architecture. Both nasm and ndisasm are available on the PATH.

Examples:

nasm -f win64 shellcode.asm -o shellcode.obj
ndisasm -b 32 shellcode.bin

Notepad++ is a free source code editor and Notepad replacement that supports several programming languages and natural languages.

OfficeMalScanner is a MS Office forensic tool to scan for malicious traces, like shellcode heuristics, PE-files or embedded OLE streams. Found files are being extracted to disk. It supports disassembly and hexview as well as an easy brute force mode to detect encrypted files.

Examples:

OfficeMalScanner.exe "C:\File.xls" scan brute debug
OfficeMalScanner.exe "C:\File.xls" info

Process Hacker is a powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. It shows detailed process, thread, handle, module and network information for running processes.

SQLECmd is a tool to find and process SQLite files according to your needs with maps.

Examples:

SQLECmd.exe -f "C:\Temp\someFile.db" --csv "c:\temp\out"
SQLECmd.exe -d "C:\Temp\" --csv "c:\temp\out"
SQLECmd.exe -d "C:\Temp\" --hunt --csv "c:\temp\out"

SQLite CLI is an application that accepts user input and passes it down into the SQLite library for evaluation.

Examples:

$ sqlite3 ex1
SQLite version 3.36.0 2021-06-18 18:36:39
Enter ".help" for usage hints.
sqlite> create table tbl1(one text, two int);
sqlite> insert into tbl1 values('hello!',10);
sqlite> insert into tbl1 values('goodbye', 20);
sqlite> select * from tbl1;
hello!|10
goodbye|20
sqlite>

Steghide is a steganography program that is able to hide data in various kinds of image and audio files.

Examples:

steghide info image.jpg
steghide embed -ef file.txt -cf image.jpg
steghide extract -sf image.jpg

Timeline Explorer is a tool for viewing CSV and Excel files, as well as applying filters.

TrID is a utility designed to identify file types from their binary signatures. While there are similar utilities with hard coded logic, TrID has no fixed rules. Instead, it's extensible and can be trained to recognize new formats in a fast and automatic way.

Examples:

trid c:\test\mydoc.doc
trid c:\temp\* -ae
dir d:\testdrive /s /b | trid -ce -@

Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.

Examples:

velociraptor gui

WinPython is a free open-source portable distribution of the Python programming language for Windows 10/11 and scientific and educational usage.

YARA is an open-source tool designed to help malware researchers identify and classify malware samples. It makes it possible to create descriptions (or rules) for malware families based on textual and/or binary patterns. YARA is multi-platform, running on Linux, Windows and Mac OS X. It can be used through its command-line interface or from Python scripts with the YARA-Python extension.

Examples:

yara /foo/bar/rules1 /foo/bar/rules2 .
yara -t Packer -t Compiler /foo/bar/rules bazfile
yara -r /foo

Online search provides right-click shortcuts that submit a file hash or sample to online analysis services, including VirusTotal, Hybrid Analysis, Malware Bazaar and the Kaspersky Threat Intelligence Portal.

1768.py decrypts and dumps the configuration of Cobalt Strike Windows beacons (PE files), shellcode and memory dumps.

pdfid.py triages a PDF by counting the keywords that matter - /JS, /JavaScript, /OpenAction, /Launch, /EmbeddedFile - so a suspicious document can be spotted before it is opened.

Examples:

pdfid suspicious.pdf
pdfid -e suspicious.pdf

pdf-parser.py walks the objects inside a PDF and can extract and decompress streams, which is the follow-up to a pdfid triage.

Examples:

pdf-parser -s JavaScript suspicious.pdf
pdf-parser -o 12 -f -d out.bin suspicious.pdf

oletools is a package of Python tools to analyze Microsoft OLE2 files.

Examples:

oleid test.vb
olevba test.vb
olevba - deobf - reveal test.vb
olevba "test.xlsm"

pefile is a multi-platform Python module to parse and work with Portable Executable (PE) files. Most of the information contained in the PE file headers is accessible, as well as all the sections' details and data.