-Analysis_Length_4219_ScanTime-_Milliseco.thumb.png.adb594106f8376141771eaee5ba34ea7.png)
About This File
This is a scan tool for Microsoft Windows executables, libraries, drivers and mdumps. Its main objective is to collect the necessary information to facilitate the identification of malicious code within the analyzed files. This tool analyzes, among other things, the PE header and its structure, the content of the sections, the different types of strings, among many other things. It also incorporates a multitude of its own ideas to recognize anomalies in the construction of files and the detection of mechanisms used by current malware.
Using the tool is simple, just configure the options in the drop-down panel on the right and drag the samples into 4n4lDetector.
Full support:
- 32 bits (8086, x86, ARMv7)
- 64 bits (AMD64, x86-64, x64, ARMv8)
TI and ET Extraction:
Alpha AXP, ARM, ARM Thumb-2 (32-bit Thumb), ARM64, EFI Byte Code, EFI Byte Code (EBC), Hitachi SH3, Hitachi SH3, Hitachi SH4, Hitachi SH5, Intel i860, Intel Itanium (IA-64), M32R, MIPS16, MIPS16 with FPU, MIPS R3000, MIPS R4000, MIPS with FPU, MIPS little-endian, MIPS little-endian WCE v2, x64, x86, x86-64.
Buttons code:
- Buttons colored green are action buttons that open files and folders or are used to interact with the tool's utilities.
- The buttons colored in red perform reconfigurations, deletion of data or reset of functional files.
- Purple buttons announce the activation of online interactions.
- The pink buttons are shortcut buttons that the tool uses as tabs to navigate between different types of utilities.
Shortcuts:
- [A] Main analysis tab
- [W] Analysis tab in modifiable HTML format for report (WebView)
- [S] Viewer of strings extracted from the parsed file
- [V] Module with the Virustotal report using its API
Detections:
- PE Information
- Unusual Entry Point Position or Code (Algorithms, Anomalous Instructions... )
- Packers
- Compilations
- Binders/Joiners/Crypters
- Architectures
- Possible malicious functions
- Registry Keys
- Files Access
- Juicy Words
- Anti-VM/Sandbox/Debug
- URLs Extractor
- Payloads
- AV Services
- Duplicate Sections
- IP/Domains List
- Config RAT (Only In Memory Dumps)
- Call API By Name
- Unusual Chars In Description File (Polymorphic Patterns)
- Rich Signature Analyzer
- CheckSum Integrity Problem
- PE Integrity Check
- SQL Queries
- Emails
- Malicious resources
- PE Carve
- Exploits
- File Rules for Entry Points and more... 😃
Console Options (Analysis to file):
- 4n4lDetector.exe Path\App.exe -GUI (Start the graphical interface parsing a file from the console)
- 4n4lDetector.exe Path\App.exe -GREMOVE (Remove binary after scan)
- 4n4lDetector.exe Path\App.exe -TXT (Parse a file from the console and the output is written to a TXT file)
- 4n4lDetector.exe Path\App.exe -HTML (Parse a file from the console and the output is written to HTML file)
Edited by 4n0nym0us
What's New in Version 3.0.0 See changelog
Released
[+] The function search code for "Import Table" and "Call Api By Name" has been optimized.
[+] A general optimization has been performed with one of the largest buffers in memory, this positively affects the stability and speed of the general analysis.
[+] The size of the file to be analyzed has been increased by default to 50MB.
[+] An optimization has been made in the search engine for the "Show Offsets" option and in the handling of buffers.
[+] Searches for generic malware terms, different types of exploitation, APTs and terminologies that may affect the State in "4n4l.Rules" have been included.
[+] A cleaning of null bytes 0x00 is performed in the variable where the report is stored to avoid bugs in the output of the text box of the main form.
[+] The tool interface takes on a darker base tone.
[+] A donation button via (PAYPAL) has been included since I have finally decided to continue with the project publicly for everyone.
[+] A bug was fixed in which false functions could be included in the "Export Table" list by carving.
[+] The Interest's Words module includes new internal words for the tool, for ansi and unicode.
[+] A bug in the web view was fixed that could aesthetically affect the view of the Interest's Words module statement.
[+] Optimizations were made in the Known IP/Domains module for ansi and unicode.
[+] New search syntaxes were included in the "Intelligent Strings" module to increase interesting results.
-> Internal cleanup syntaxes were added to show more stylized results.
-> An optimization has been made with a direct impact on the variables used in this module.
[+] A more selective cleaning of the extracted URLs is performed:
-> URLs with extensions in the context of PKI digital certificates are reconstructed.
-> Htm extensions are reconstructed.
-> ".com" domain endings are cleaned.
-> Possible HTML code cleaning is performed.
[+] A progression system based on medals has been included.
-> Brown Padawan Medal, Bronze Medal, Silver Medal, Gold Medal and Platinum Medal.
-> The process can be slow, don't despair... because it's worth it.
-> These medals will be earned as you use the tool over the course of days, weeks, months and consequently their functionality will also increase progressively.
-> The medals will only work on the work machine on which they have been earned, if you want to make it work on another machine of yours try it yourself (You're a hacker, right?).
-> The features or surprises that come with leveling up are not included in this file, although you can review them in the "Settings" section of the tool.
Recommended Comments
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now