-Analysis_Length_4219_ScanTime-_Milliseco.thumb.png.adb594106f8376141771eaee5ba34ea7.png)
About This File
This is a scan tool for Microsoft Windows executables, libraries, drivers and mdumps. Its main objective is to collect the necessary information to facilitate the identification of malicious code within the analyzed files. This tool analyzes, among other things, the PE header and its structure, the content of the sections, the different types of strings, among many other things. It also incorporates a multitude of its own ideas to recognize anomalies in the construction of files and the detection of mechanisms used by current malware.
Using the tool is simple, just configure the options in the drop-down panel on the right and drag the samples into 4n4lDetector.
Full support:
- 32 bits (8086, x86, ARMv7)
- 64 bits (AMD64, x86-64, x64, ARMv8)
TI and ET Extraction:
Alpha AXP, ARM, ARM Thumb-2 (32-bit Thumb), ARM64, EFI Byte Code, EFI Byte Code (EBC), Hitachi SH3, Hitachi SH3, Hitachi SH4, Hitachi SH5, Intel i860, Intel Itanium (IA-64), M32R, MIPS16, MIPS16 with FPU, MIPS R3000, MIPS R4000, MIPS with FPU, MIPS little-endian, MIPS little-endian WCE v2, x64, x86, x86-64.
Buttons code:
- Buttons colored green are action buttons that open files and folders or are used to interact with the tool's utilities.
- The buttons colored in red perform reconfigurations, deletion of data or reset of functional files.
- Purple buttons announce the activation of online interactions.
- The pink buttons are shortcut buttons that the tool uses as tabs to navigate between different types of utilities.
Shortcuts:
- [A] Main analysis tab
- [W] Analysis tab in modifiable HTML format for report (WebView)
- [S] Viewer of strings extracted from the parsed file
- [V] Module with the Virustotal report using its API
Detections:
- PE Information
- Unusual Entry Point Position or Code (Algorithms, Anomalous Instructions... )
- Packers
- Compilations
- Binders/Joiners/Crypters
- Architectures
- Possible malicious functions
- Registry Keys
- Files Access
- Juicy Words
- Anti-VM/Sandbox/Debug
- URLs Extractor
- Payloads
- AV Services
- Duplicate Sections
- IP/Domains List
- Config RAT (Only In Memory Dumps)
- Call API By Name
- Unusual Chars In Description File (Polymorphic Patterns)
- Rich Signature Analyzer
- CheckSum Integrity Problem
- PE Integrity Check
- SQL Queries
- Emails
- Malicious resources
- PE Carve
- Exploits
- File Rules for Entry Points and more... 😃
Console Options (Analysis to file):
- 4n4lDetector.exe Path\App.exe -GUI (Start the graphical interface parsing a file from the console)
- 4n4lDetector.exe Path\App.exe -GREMOVE (Remove binary after scan)
- 4n4lDetector.exe Path\App.exe -TXT (Parse a file from the console and the output is written to a TXT file)
- 4n4lDetector.exe Path\App.exe -HTML (Parse a file from the console and the output is written to HTML file)
Edited by 4n0nym0us
What's New in Version 2.8.0 See changelog
Released
Video tutorial (Spanish):
https://www.youtube.com/watch?v=-zCPk_nuY4c
New features added:
[+] A notice is added to the sections section when the identified section is executable.
[+] The SHA-256 and SHA-1 Hashes of all analyzed files are now also calculated.
[+] Including the original name of the analyzed library in the "[Export Table]" button.
[+] Now 4n4lDetector is able to identify content in the Import Table even though the "Original First Thunk" Offset is at "0" as in UPX tablets.
[+] The "Settings" module now has a subtle optimization to avoid freezes when downloading notifications.
[+] The code responsible for resource extraction has been optimized, it is now faster.
[+] Entry Point extraction has been restructured, optimizing its code and improving extraction speed.
[+] Optimized and removed some of the internal rules of 4n4lDetector to avoid some false positives.
[+] The file description extractor algorithm was modified, it is now more effective.
[+] The Carving PE result is now stored in a folder called PECarve within the analysis section.
[+] Virustotal information has been relocated to the main panel. (Use your personal API_KEY).
-> SORRY MICROSOFT... I think we are at peace after that CobaltStrike detection ❤️
[+] The "IT Functions:" section of the main analysis is now called "Suspicious functions:", this being more accurate.
-> Functions now have a description of their functionalities.
[+] The "Strings" functionality now runs automatically, visible in the "S" button after scans while "Intelligent Strings" is active.
-> Increased the effectiveness and speed of the "Intelligent Strings" module and the "Strings" functionality.
[+] The "Sections Info" option is now internal and in its place an optional one has been created to decompress UPX samples.
-> The unzipped samples are stored in the analysis path, within a folder called UPX.
-> The UPX binary is located in the root of 4n4lDetector, in a folder called "bin" and can be modified by the user.
[+] The verification of signed executables, the checksum signature and the Rich signature are now grouped in the "Signatures" section.
[+] Changes in the management of the Rich firm.
-> The entire signature is extracted, not just the first part.
-> Added a hash for detection.
-> its integrity is verified with a review of the old algorithm.
[+] A new tool has been added to extract Offsets directly from the executable and view its contents.
-> It is now possible to manually perform code searches in hexadecimal, ASCII and UNICODE.
-> A functionality to review the assembly code has also been included.
-> This tool executes its main functions automatically with the Entry Point after each analysis.
[+] Added extraction of import and export tables from the rest of the existing executable architectures.
-> Alpha AXP, ARM, EFI Byte Code, EFI Byte Code (EBC), Hitachi SH3, Hitachi SH3, Hitachi SH3, Hitachi SH4, Hitachi SH5, Intel Itanium (IA-64), Intel i860, M32R, MIPS16, MIPS16 with FPU, MIPS R3000, MIPS R4000, MIPS little-endian, MIPS little-endian WCE v2, MIPS with FPU.
Recommended Comments
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now