Skip to content

Instantly share code, notes, and snippets.

@adulau

adulau/automatic-analysis-suspicious-binaries.md

Created March 20, 2021 07:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save adulau/ee99dc40bad5544eb635eb780e46b5ce to your computer and use it in GitHub Desktop.
Save adulau/ee99dc40bad5544eb635eb780e46b5ce to your computer and use it in GitHub Desktop.
Download ZIP
Notes for automatic analysis suspicious binaries
Raw
automatic-analysis-suspicious-binaries.md

Tools

capa (from fireeye)

capa detects capabilities in executable files. You run it against a PE file or shellcode and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing services, or relies on HTTP to communicate.

Papers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment