Malware analysis samples

Donut is a toolset for loading and executing payloads in memory, featuring a position-independent shellcode generator, an in-memory payload injector, and a .NET assembly loader. It is designed to convert executable files and scripts into shellcode that can be executed within the memory space of a remote process without writing files to disk. The project specializes in security evasion through memory-based patching and payload obfuscation using symmetric block ciphers and compression. It includes a remote payload stager to retrieve encrypted modules from HTTP or DNS servers during runtime, red

OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje

Veil-Evasion is a framework designed for generating custom executable files to test defensive systems. It functions as a security testing utility that simulates patterns used to bypass security software during authorized penetration testing. The platform distinguishes itself through a modular build system that transforms scripts into standalone native binaries, ensuring consistent execution across different operating systems without external dependencies. It utilizes template-based source injection to construct these payloads, allowing for the dynamic configuration of executable files during

Pafish is an anti-analysis sandbox detector and virtualization environment tester. It serves as a diagnostic utility to identify if a system is running inside a virtual machine or a malware analysis sandbox by executing common anti-analysis techniques. The tool validates the effectiveness of various evasion methods and supports research into sandbox detection. It tests whether a target system can be recognized as a virtualized environment to help improve the stealth of malware analysis environments. Detection is achieved through a variety of behavioral checks, including hardware artifact ana

This project is a suite of tools for generating encoded shell commands and network listener configurations used in offensive security operations. It provides a collection of command generators for various shells and listeners to establish remote access during security penetration tests. The tool features a reverse shell payload generator that creates encoded command strings and a network listener command generator that produces the server-side syntax needed to accept incoming network connections. It includes a Base64 command encoder to transform shell commands into encoded strings to bypass s

This project is a security research utility designed to evaluate and test the detection capabilities of antivirus products. It provides a framework for generating custom, memory-resident loaders that execute payloads directly within a process memory space, bypassing standard file-based execution monitoring. The tool distinguishes itself by employing compiler-driven generation to create unique executable binaries, which avoids the predictable patterns associated with pre-compiled security software. It incorporates dynamic control flow obfuscation to hinder static analysis and utilizes payload

Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems. The framework distinguishes itself through a focus on memory-resident operations, allowing for the execution of encrypted binaries and shellcode directly within system memory. By utilizing techniques such as junk code injection, payload encryption, and remote

Welcome to the Malware Development workshop for AfricaHackon 2021. In this interactive workshop, we will take a look at the C# language and how to write malware focused on droppers/loaders that will run shellcode on Windows 10 targets that give a meterpreter session back.

This project is a set of specialized utilities for generating malformed documents, obfuscating payloads, and crafting specific attack vectors to evaluate the resilience of security scanners. It functions as a PDF fuzzing framework and security testing tool designed to create PDF files with embedded payloads for verifying how document viewers and web applications handle vulnerabilities. The toolkit provides capabilities for encoding and hiding malicious content to test the detection effectiveness of security scanners. It includes a security payload generator for crafting specific attack vector

Movfuscator is an obfuscating compiler that transforms C source code into x86 machine code consisting exclusively of move instructions. It implements all program logic, arithmetic, and control flow using a move-only instruction set to hide the execution path and prevent reverse engineering. The project includes a move-only library that performs double precision floating point calculations without using native floating point instructions. It also features a translator that converts these move-only binaries into restricted data transfers and indexed addressing for compatibility with RISC archit

This project is a JavaScript code protection tool designed to transform source code into a version that is difficult for humans to read. Its primary purpose is to protect intellectual property and prevent reverse engineering by altering the original program logic. The tool employs several advanced techniques to hinder analysis, including control flow flattening and the injection of dead code. It can compile functions into custom bytecode executed by an embedded virtual machine and encrypt string literals to prevent static analysis of text. Additional capabilities include anti-debugging mecha

jsfuck is an esoteric programming language and JavaScript source obfuscator. It functions as a code encoder that transforms standard JavaScript source code into a functional equivalent composed of a minimal character set. The project restricts its source code to six specific characters to hide logic and bypass security filters that block standard alphanumeric characters. It achieves this by using type coercion to derive symbols and accessing internal language objects through prototype manipulation. The system enables arbitrary JavaScript execution by converting strings into executable functi