# Malware Analysis Tool Inventory

Complete inventory of tools for malware analysis, organized by category. Includes installation instructions for both Linux and Windows.

## Disassemblers & Decompilers

### Ghidra
- **Purpose**: NSA's open-source reverse engineering suite with decompiler
- **Platforms**: Linux, Windows, macOS
- **Linux Install**: `wget https://github.com/NationalSecurityAgency/ghidra/releases/...` or via `setup_remnux.sh`
- **Windows Install**: `choco install ghidra`
- **Requires**: Java 17+

### IDA Free
- **Purpose**: Industry-standard disassembler (free version for non-commercial use)
- **Platforms**: Windows, Linux
- **Windows Install**: `choco install ida-free`
- **Linux Install**: Download from https://hex-rays.com/ida-free/

### radare2
- **Purpose**: Open-source reverse engineering framework with CLI interface
- **Platforms**: Linux, Windows, macOS
- **Linux Install**: `git clone https://github.com/radareorg/radare2 && cd radare2 && sys/install.sh`
- **Windows Install**: `choco install radare2`
- **GUI**: Cutter (`choco install cutter` / `apt install cutter`)

### RetDec
- **Purpose**: Avast's open-source machine-code decompiler
- **Platforms**: Linux, Windows
- **Linux Install**: `apt install retdec` or from GitHub releases
- **Windows Install**: Download from https://github.com/avast/retdec/releases

## Debuggers

### x64dbg
- **Purpose**: Open-source Windows debugger for x86/x64
- **Platforms**: Windows
- **Install**: `choco install x64dbg.portable`
- **Plugins**: ScyllaHide, xAnalyzer, TitanHide

### WinDbg
- **Purpose**: Microsoft's Windows debugger, kernel and user mode
- **Platforms**: Windows
- **Install**: `choco install windbg` or via Microsoft Store (WinDbg Preview)

### GDB
- **Purpose**: GNU Debugger for Linux binaries
- **Platforms**: Linux
- **Install**: `apt install gdb`
- **Extensions**: GEF (`pip install gef`), PEDA, pwndbg

### strace / ltrace
- **Purpose**: Trace system calls (strace) and library calls (ltrace)
- **Platforms**: Linux
- **Install**: `apt install strace ltrace`

## Capability & Signature Analysis

### Mandiant capa
- **Purpose**: Identify capabilities in executables using rules
- **Platforms**: Linux, Windows
- **Linux Install**: Download binary from GitHub releases or via `setup_remnux.sh`
- **Windows Install**: Via `setup_flarevm.ps1`
- **Usage**: `capa sample.exe`, `capa -j sample.exe` (JSON output)

### YARA
- **Purpose**: Pattern matching for malware identification
- **Platforms**: Linux, Windows, macOS
- **Linux Install**: Compile from source or `apt install yara`
- **Windows Install**: `choco install yara`
- **Python binding**: `pip install yara-python`

### ssdeep
- **Purpose**: Fuzzy hashing for similarity comparison
- **Platforms**: Linux, Windows
- **Install**: `apt install ssdeep`

## PE / ELF / Mach-O Analysis

### PE-bear
- **Purpose**: Portable Executable (PE) file parser and viewer
- **Platforms**: Windows, Linux
- **Install**: `choco install pe-bear` / Download from GitHub

### PEStudio
- **Purpose**: Static analysis of PE files, highlights suspicious indicators
- **Platforms**: Windows
- **Install**: `choco install pestudio`

### CFF Explorer
- **Purpose**: PE editor with support for .NET metadata
- **Platforms**: Windows
- **Install**: `choco install cff-explorer`

### Detect It Easy (DIE)
- **Purpose**: Detect packers, compilers, linkers, and protectors
- **Platforms**: Windows, Linux
- **Install**: `choco install die` / Download from GitHub

### readelf / objdump
- **Purpose**: ELF file analysis (Linux binaries)
- **Platforms**: Linux
- **Install**: `apt install binutils`

### pefile (Python)
- **Purpose**: Python library for PE file parsing
- **Install**: `pip install pefile`

### LIEF
- **Purpose**: Library for parsing PE, ELF, Mach-O
- **Install**: `pip install lief`

## .NET Analysis

### dnSpy
- **Purpose**: .NET debugger and assembly editor
- **Platforms**: Windows
- **Install**: `choco install dnspy`

### ILSpy
- **Purpose**: .NET decompiler
- **Platforms**: Windows, Linux (CLI)
- **Install**: `choco install ilspy`

### de4dot
- **Purpose**: .NET deobfuscator
- **Platforms**: Windows
- **Install**: `choco install de4dot`

### dnfile (Python)
- **Purpose**: Parse .NET PE files in Python
- **Install**: `pip install dnfile`

## Document Analysis

### oletools
- **Purpose**: Analyze OLE/MS Office documents for macros and exploits
- **Platforms**: Linux, Windows
- **Install**: `pip install oletools`
- **Key tools**: `olevba` (extract VBA), `oleid` (indicators), `rtfobj` (RTF objects)

### pdf-parser / pdfid
- **Purpose**: Analyze PDF files for suspicious elements
- **Platforms**: Linux, Windows
- **Install**: `pip install pdftools` or download from Didier Stevens' site

## Network Analysis

### Wireshark / tshark
- **Purpose**: Network protocol analyzer with GUI (Wireshark) and CLI (tshark)
- **Platforms**: Linux, Windows, macOS
- **Linux Install**: `apt install wireshark tshark`
- **Windows Install**: `choco install wireshark`

### tcpdump
- **Purpose**: CLI packet capture utility
- **Platforms**: Linux, macOS
- **Install**: `apt install tcpdump`

### INetSim
- **Purpose**: Simulate internet services (HTTP, DNS, SMTP, FTP) for analysis
- **Platforms**: Linux
- **Install**: `apt install inetsim`

### FakeNet-NG
- **Purpose**: Dynamic network analysis tool for Windows
- **Platforms**: Windows, Linux
- **Install**: `pip install fakenet` or download from GitHub

### mitmproxy
- **Purpose**: Interactive HTTPS proxy for inspecting encrypted traffic
- **Platforms**: Linux, Windows, macOS
- **Install**: `pip install mitmproxy`

### Fiddler
- **Purpose**: Web debugging proxy
- **Platforms**: Windows
- **Install**: `choco install fiddler`

## Process & System Monitoring

### Sysinternals Suite
- **Purpose**: Windows system utilities (Process Monitor, Process Explorer, Autoruns, etc.)
- **Platforms**: Windows
- **Install**: `choco install sysinternals`
- **Key tools**: `procmon` (API monitoring), `procexp` (process tree), `autoruns` (persistence)

### Process Hacker
- **Purpose**: Advanced process viewer and system monitor
- **Platforms**: Windows
- **Install**: `choco install processhacker`

### API Monitor
- **Purpose**: Monitor and control API calls
- **Platforms**: Windows
- **Install**: `choco install apimonitor`

## Memory Forensics

### Volatility 3
- **Purpose**: Memory forensics framework
- **Platforms**: Linux, Windows
- **Install**: `pip install volatility3` or `apt install volatility3`

## Hex Editors

### HxD
- **Purpose**: Fast hex editor
- **Platforms**: Windows
- **Install**: `choco install hxd`

### 010 Editor
- **Purpose**: Professional hex editor with binary templates
- **Platforms**: Windows, Linux, macOS
- **Install**: `choco install 010editor` (commercial license)

### xxd
- **Purpose**: CLI hex dump utility
- **Platforms**: Linux
- **Install**: `apt install xxd` (usually pre-installed)

## Emulation & Sandboxing

### unicorn
- **Purpose**: CPU emulation framework
- **Install**: `pip install unicorn`

### angr
- **Purpose**: Binary analysis framework with symbolic execution
- **Install**: `pip install angr`

### QEMU
- **Purpose**: Machine emulator for running other architectures
- **Platforms**: Linux, Windows
- **Install**: `apt install qemu-system`

## Encoding & Crypto

### CyberChef
- **Purpose**: Web-based data transformation tool ("The Cyber Swiss Army Knife")
- **Platforms**: Web, offline build
- **Install**: `choco install cyberchef` or download from GitHub

### pycryptodome
- **Purpose**: Python cryptographic library for implementing/breaking crypto
- **Install**: `pip install pycryptodome`

## Threat Intelligence

### MISP
- **Purpose**: Threat intelligence sharing platform
- **Platforms**: Linux
- **Install**: See https://www.misp-project.org/download/

### stix2 (Python)
- **Purpose**: Create and parse STIX 2.1 threat intelligence objects
- **Install**: `pip install stix2`

### YARA rules repositories
- **Purpose**: Community YARA rules for known threats
- **URL**: https://github.com/Yara-Rules/rules