Open-source alternatives to Malfunction

PEframe is a open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

HashCheck Shell Extension for Windows with added SHA2, SHA3, and multithreading; originally from code.kliu.org

Wraps around various tools and provides some additional checks/information to produce a centralized report of a PE file.

Detect-It-Easy is a binary file identifier and analysis toolkit designed to determine file formats, compilers, and packers. It functions as a binary file identifier that utilizes signature matching and heuristic analysis to identify executable and archive formats. The project includes a custom file signature engine and a scriptable rule system for defining and applying detection logic to identify specific binary patterns. It features specialized detectors for Android packages, such as APK and DEX files, and a malware packer detector to identify protections, obfuscators, and virus families. T

Linker/Compiler/Tool detector for Windows, Linux and MacOS.

This is md5deep, a set of cross-platform tools to compute hashes, or message digests, for any number of files while optionally recursively digging through the directory structure. It can also take a list of known hashes and display the filenames of input files whose hashes either do or do not…

A static analyzer for PE executables.

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

Malware static analysis framework

Modular file scanning/analysis framework

Loki is an endpoint detection tool, forensic artifact analyzer, and threat intelligence scanner. It functions as a YARA-based indicator of compromise scanner designed to identify malicious persistence mechanisms, web shells, and unauthorized administration tools across local and remote systems. The project distinguishes itself by integrating multi-source threat intelligence, allowing for the loading of custom signature sets and encrypted indicators. It combines hash-based artifact detection with YARA rule execution to scan files, process memory, and registry hives for known malicious byte seq

yarGen is a generator for YARA rules

Checks with NSRL RDS servers looking for for hash matches

Fork of packerid.py

A Single Library Parser to extract meta information,static analysis and detect macros within the files.

Simple tool to find the yara matches on a file