Search Results for "malware analysis"

PE-bear is a multiplatform reversing tool for inspecting Windows Portable Executable files. It is designed to give malware analysts and reverse engineers a fast first view of a PE file’s structure. The tool can handle malformed PE files, which is important when analyzing packed, damaged, or intentionally manipulated binaries. It provides a graphical interface for exploring headers, sections, imports, resources, strings, and other PE internals. PE-bear also includes analysis conveniences such as hashes, signatures, and searchable string views. ...

...Its goal is to add a reflective loading stub after compilation, instead of requiring the developer to build the PE with reflective loading already integrated. This makes it useful for controlled security research, malware analysis labs, and educational work on PE loading behavior. Because the technique is closely related to in-memory execution, it should be handled only in authorized environments.

With the Log Parser one can scan logs, whitelist out legitimate, non-corrupt entries (usually file paths), and apply a standard format to a log generated by any antivirus or malware-removal program. This makes for easier reading of the meat in any log.