-Analysis_Length_4219_ScanTime-_Milliseco.png.9b68973f4ab29db082e64e9264822f85.png)
This is a scan tool for Microsoft Windows executables, libraries, drivers and mdumps. Its main objective is to collect the necessary information to facilitate the identification of malicious code within the analyzed files. This tool analyzes, among other things, the PE header and its structure, the content of the sections, the different types of strings, among many other things. It also incorporates a multitude of its own ideas to recognize anomalies in the construction of files and the detection of mechanisms used by current malware.
Using the tool is simple, just configure the options in the drop-down panel on the right and drag the samples into 4n4lDetector.
Full support:
- 32 bits (8086, x86, ARMv7)
- 64 bits (AMD64, x86-64, x64, ARMv8)
TI and ET Extraction:
Alpha AXP, ARM, ARM Thumb-2 (32-bit Thumb), ARM64, EFI Byte Code, EFI Byte Code (EBC), Hitachi SH3, Hitachi SH3, Hitachi SH4, Hitachi SH5, Intel i860, Intel Itanium (IA-64), M32R, MIPS16, MIPS16 with FPU, MIPS R3000, MIPS R4000, MIPS with FPU, MIPS little-endian, MIPS little-endian WCE v2, x64, x86, x86-64.
Buttons code:
- Buttons colored green are action buttons that open files and folders or are used to interact with the tool's utilities.
- The buttons colored in red perform reconfigurations, deletion of data or reset of functional files.
- Purple buttons announce the activation of online interactions.
- The pink buttons are shortcut buttons that the tool uses as tabs to navigate between different types of utilities.
Shortcuts:
- [A] Main analysis tab
- [W] Analysis tab in modifiable HTML format for report (WebView)
- [S] Viewer of strings extracted from the parsed file
- [V] Module with the Virustotal report using its API
Detections:
- PE Information
- Unusual Entry Point Position or Code (Algorithms, Anomalous Instructions... )
- Packers
- Compilations
- Binders/Joiners/Crypters
- Architectures
- Possible malicious functions
- Registry Keys
- Files Access
- Juicy Words
- Anti-VM/Sandbox/Debug
- URLs Extractor
- Payloads
- AV Services
- Duplicate Sections
- IP/Domains List
- Config RAT (Only In Memory Dumps)
- Call API By Name
- Unusual Chars In Description File (Polymorphic Patterns)
- Rich Signature Analyzer
- CheckSum Integrity Problem
- PE Integrity Check
- SQL Queries
- Emails
- Malicious resources
- PE Carve
- Exploits
- File Rules for Entry Points and more... 😃
Console Options (Analysis to file):
- 4n4lDetector.exe Path\App.exe -GUI (Start the graphical interface parsing a file from the console)
- 4n4lDetector.exe Path\App.exe -GREMOVE (Remove binary after scan)
- 4n4lDetector.exe Path\App.exe -TXT (Parse a file from the console and the output is written to a TXT file)
- 4n4lDetector.exe Path\App.exe -HTML (Parse a file from the console and the output is written to HTML file)
Edited by 4n0nym0us
What's New in Version 3.3.0
Released
Changelog v3.3
Fixed a rare bug that could show the spinning hacker logo after completing the first analysis.
Added extraction of the IAT disk address in the Information section.
“Show Offsets” notifications now display information about the offset location when pressing DUMP or Disassemble.
Added overflow controls in external signature modules.
Revised section count handling for PE files with corrupted headers.
Adjusted Subsystem and MajorOSVersion identifiers in PE files.
Added MinorOSVersion field to the Information analysis.
Reviewed the function for counting duplicate sections in PE headers.
Completely restructured the SQL extraction module now much more powerful.
Reviewed the File Access execution extraction section.
Improved name detection in Export Table carving.
The options form now remains visible during analysis if it was open. (REVISION2)
Fixed a rare bug affecting the Finder’s UNICODE string search.
Slightly increased detections in Intelligent String section.
Added exclusive string cleaning for Golang-compiled binaries.
Reviewed the File Access module.
Maximized Unicode string extraction capability.
Improved ASCII cleaning to reduce Golang compiler false positives.
Reviewed the Sections module.
Added entropy and Chi² calculations for file sections.
Included full flag descriptions for all sections.
Unnamed sections now appear as unnamed.
Rebalanced the Flow Anomalies module.
Added padding and header detection for fragments between sections.
Included reading of TLS Callbacks.
Improved detection speed for shellcode and payload instructions.
Adjusted opcode interpretation with ModR/M and SIB to differentiate simple Displacement form from complex ModRM/SIB parsed, maintaining backward compatibility.
Junk code detection at entry points now applies to the entire PE file.
Section field detection is now explicitly tied to disk offsets.
The heuristic module now includes the [cnf] shortcut to open [Settings].
Extended x64 instruction translation support.
Added a new “Indirect Call/Jump” heuristic options section in [Settings] for indirect call and jump control.
Allows setting the code size to analyze (Decimal, 1,000–100,000 bytes).
Init Offset defines the starting analysis point, storable in decimal or hexadecimal.
CALL [static], JMP [static], CALL [reg], and JMP [reg] can be toggled individually.
“Indirect Call/Jump” configurations are automatically saved and loaded at startup, and can be deleted from the Config files section.
-
4
-
3
Recommended Comments
Create an account or sign in to comment