1<!DOCTYPE HTML> 2 3<!-- 4Strata by HTML5 UP 5html5up.net | @n33co 6Free for personal and commercial use under the CCA 3.0 license (html5up.net/license) 7--> 8<html> 9 <head> 10 <title>Practical Malware Analysis Starter Kit · bluesoul [dot] net</title> 11 <meta charset="utf-8" /> 12 <meta name="viewport" content="width=device-width, initial-scale=1" /> 13 <meta name="author" content="bluesoul"> 14 <meta name="description" content="A blog about information security and systems administration and management."> 15 <meta http-equiv="content-language" content="en-us" /> 16 17 <meta name="generator" content="Hugo 0.17" /> 18 19 <!--[if lte IE 8]>
19<script src='{{ .Site.BaseURL }}js/ie/html5shiv.js'></script>
19<![endif]--> 20 <link rel="stylesheet" href="//maxcdn.bootstrapcdn.com/font-awesome/4.5.0/css/font-awesome.min.css" type="text/css"> 21 <link href='https://d33wubrfki0l68.cloudfront.net/css/4f1a07caa1cedb8bec8e7d12c5f2bfece251e377/css/main.css' rel='stylesheet'/> 22 <!--[if lte IE 8]><link rel='stylesheet' href='{{ .Site.BaseURL }}/css/ie8.css' /><![endif]--> 23 24 25 </head> 26 27 <body id="top"> 28 <!-- Header --> 29<header id="header"> 30 <a href="/" class="image avatar"><img src="https://d33wubrfki0l68.cloudfront.net/8571b84e5a298c8bf45a097ade57d8b0c0916182/80688/images/avatar.jpg" alt="" /></a> 31 32 <h1>I’m a CTO, former sysadmin and occasional malware researcher and rabbit-hole spelunker. I’m not here to sell anything.</h1> 33 34 35 36 <nav id="sidebar"> 37 <ul> 38 39 <li><a href="/">Home</a></li> 40 41 <li><a href="/about">About</a></li> 42 43 <li><a href="/practical-malware-analysis-starter-kit">Practical Malware Analysis Starter Kit</a></li> 44 45 <li><a href="/post/">Blog</a></li> 46 47 </ul> 48 </nav> 49 50</header> 51 52 53 <!-- Main --> 54 <div id="main"> 55 56 <span> 57 <h1>Practical Malware Analysis Starter Kit</h1> 58 59 60 61 62 63 64 65 </span> 66 67 <p> 68 <p>Package last updated: 2016-05-14</p> 69 70<p>This package contains most of the software referenced in Practical Malware Analysis. Some of the links have broken over time, some companies have folded or been bought. I’ve done what I can to compile it all in one place for my own convenience and I figured I’d share it. It contains:</p> 71 72<ul> 73<li>MD5DEEP 4.4 and related tools (sha1deep, hashdeep, whirlpooldeep, etc) and 64-bit equivalents.</li> 74<li>WinMD5Free v1.20</li> 75<li>PEiD v0.95 with KANAL plugin</li> 76<li>Strings v2.52</li> 77<li>upx 3.91</li> 78<li>PEview v0.9.9</li> 79<li>Resource Hacker v4.2.5</li> 80<li>PEBrowse Professional v10.1.4</li> 81<li>PEBrowse64 Professional v6.3.1</li> 82<li>PE Explorer 1.99 R6 (Trial)</li> 83<li>Process Monitor (procmon) v3.2</li> 84<li>Process Explorer (procexp) v16.10</li> 85<li>Regshot v1.9.0</li> 86<li>ApateDNS v1.0</li> 87<li>Netcat (nc) 1.11 and 64-bit build</li> 88<li>Wireshark v2.0.3</li> 89<li>FakeNet 1.0c (INetSim alternative for Windows)</li> 90<li>Combined Volume Set of Intel® 64 and IA-32 Architectures Software Developerâs Manuals</li> 91<li>IDA Pro Free v5.0 with FindCrypt plugin, IDA Entropy Plugin</li> 92<li>Autoruns v13.51 and autorunsc</li> 93<li>OllyDbg v1.10 and v2.01d</li> 94<li>OllyDump Plugin</li> 95<li>WinDbg x86 and x64 v6.11.1.404</li> 96<li>Immunity Debugger (ImmDbg) v1.85</li> 97<li>SoftICE 4.05 for w98 and NT/XP (SEE FOOTER)</li> 98<li>SoftIceNT 4.2.7 (from 2.7 Driver Studio build) for XP (SEE FOOTER)</li> 99<li>OSR Driver Loader v3.0</li> 100<li>Poison Ivy RAT 2.3.2 (Password is “malware” with no quotes, if the exe is eaten by your AV)</li> 101<li>pwdump6 (as PwDump.exe)</li> 102<li>pwdump7</li> 103<li>Pass-The-Hash Toolkit v1.4</li> 104<li>Metasploit Framework v4.11.7</li> 105<li>PyCrypto (Requires Python 2.7)</li> 106<li>Snort 2.9.8.2</li> 107<li>ScoopyNG v1.0</li> 108<li>Mandiant Red Curtain 1.0</li> 109<li>ASPack 2.39 (Trial)</li> 110<li>PETite v2.4</li> 111<li>WinUPack v0.39 Final</li> 112<li>Themida 2.4.1.0 (Trial)</li> 113<li>shellcode_launcher.exe (Gone from practicalmalwareanalysis.com)</li> 114<li>Bochs 2.6.8</li> 115<li>Burp Suite 1.7.03</li> 116<li>CaptureBAT 2.0.0-5574</li> 117<li>Cuckoo 2.0-RC1 (Requires Python)</li> 118<li>CFF Explorer (As Explorer Suite 4)</li> 119<li>WinHex 18.8.0.0</li> 120<li>Import REConstructor (ImpREC) 1.7e</li> 121<li>LordPE 1.41 Deluxe</li> 122<li>Malcode Analyst Pack</li> 123<li>Memoryze 3.0</li> 124<li>OfficeMalScanner 0.5</li> 125<li>Zynamics BinDiff 4.20 (Key provided by Zynamics)</li> 126<li>pdfid.py and pdf-parser.py (Requires Python, obviously)</li> 127<li>Sandboxie v5.10</li> 128<li>Buster Sandbox Analyzer v1.88 Update 4</li> 129<li>TCPView v3.05</li> 130<li>The Sleuth Kit 4.2.0 for Windows</li> 131<li>VERA v0.3</li> 132<li>Volatility 2.5</li> 133<li>Yara v1.7.1 x86 and x64</li> 134</ul> 135 136<p>Docs and Licenses when given are in their own folders.</p> 137 138<p>I recommend you add the “Portable Binaries” folder to your Windows PATH.</p> 139 140<p>WARNING: This is not a toy. There are malicious code samples provided in the labs. Poison Ivy is real C2 malware. Use extreme caution with this software.</p> 141 142<p>
142COPYRIGHT: I do not claim copyright to any of the software packaged. All software provided was freely available online, and included in one place for your convenience.</p> 143 144<p>PASSWORD: The password to open the zip is “malware” with no quotes. You will likely need to make exceptions in your AV for the folder you place and extract this package.</p> 145 146<p>REGARDING SOFTICE: The provided build of SoftICEÂ is a pirated scene release from 2000. I would consider it abandonware, as it has changed hands from NuMega to Compuware and again to Micro Focus, who has not released or updated the software. It has not received an update nor been available for purchase in ten years. If you are uncomfortable having this software, simply delete <code>SoftICE427installnt.exe</code>, <code>SI405w9x.exe</code>, and the <code>SoftICE 4.05 NT and XP</code> folder from Setup Binaries. It was exceedingly difficult to find the Windows XP version so I have included it for posterity.</p> 147 148<p>REGARDING LORDPE: LordPE looks like a pirated scene release but was actually created as a scene tool.</p> 149 150<p>Download: <a href="https://bluesoul.me/files/PMAStarterKit.zip">zip</a> or <a href="https://bluesoul.me/files/PMAStarterKit.zip.torrent">torrent</a>.</p> 151 152 </p> 153 154 <div id="disqus_thread"></div>
155<script type="text/javascript"> 156 var disqus_shortname = 'bluesoul-net'; 157 var disqus_identifier = '\/practical-malware-analysis-starter-kit\/'; 158 var disqus_title = 'Practical Malware Analysis Starter Kit'; 159 var disqus_url = '\/practical-malware-analysis-starter-kit\/'; 160 161 (function() { 162 var dsq = document.createElement('script'); dsq.type = 'text/javascript'; dsq.async = true; 163 dsq.src = '//' + disqus_shortname + '.disqus.com/embed.js'; 164 (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(dsq); 165 })(); 166</script>
166 167<noscript>Please enable JavaScript to view the <a href="http://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript> 168<a href="http://disqus.com" class="dsq-brlink">comments powered by <span class="logo-disqus">Disqus</span></a> 169 170 </div> 171 172 <!-- Footer --> 173<footer id="footer"> 174 <ul class="icons"> 175 176 177 178 <li><a href="//twitter.com/bluesouldotme" target="_blank" class="icon fa-twitter"><span class="label">Twitter</span></a></li> 179 180 181 <li><a href="//github.com/pxdnbluesoul" target="_blank" class="icon fa-github"><span class="label">Github</span></a></li> 182 183 184 185 186 187 <li><a href="/#contact-form" class="icon fa-envelope-o"><span class="label">Email</span></a></li> 188 189 </ul> 190 191 <ul class="copyright"> 192 193 <li>© bluesoul.net</li> 194 195 <li>Design: <a href="//html5up.net">HTML5 UP</a></li> 196 197 <li>Images: Bluesoul Photography</li> 198 199 </ul> 200</footer> 201 202<!-- Scripts -->
203<script src='https://d33wubrfki0l68.cloudfront.net/bundles/c7517b1a1d09568af32dfaaedffe600aa1f03235.js'></script>
203 204 205 206 207 208 209 </body> 210</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.