Malware Analysis & Forensics Tools

Examining suspicious software to learn what it does, how it spreads and how to detect it. Static analysis inspects the file without running it, and dynamic analysis observes it running in a controlled environment.

Collecting, preserving and examining digital evidence such as disk images, memory captures and logs to reconstruct what happened during an incident.

Ghidra is a reverse engineering framework with a disassembler and decompiler. Analysts use it to understand how compiled programs and malware work.

YARA matches files or memory against rules made of text and binary patterns, so analysts can identify and group malware families.

A browser-based tool for chaining operations that decode, decrypt, decompress and transform data, commonly used to unpack obfuscated malware payloads.

Autopsy is a graphical digital forensics platform based on The Sleuth Kit. It analyzes disk images, recovers deleted files and builds timelines of activity.

A typical flow collects disk and memory images, examines them with Autopsy and Volatility, pulls out suspicious files, analyzes them in Ghidra or a sandbox, decodes data with CyberChef and writes YARA rules to detect the family.

Only with care. Use isolated virtual machines or sandboxes without access to production networks, take snapshots, and handle samples as dangerous. Analyze only files you are authorized to examine.

The page lists widely used open-source and community tools across reverse engineering, decoding, sandboxing and forensics. Descriptions summarize each project's own documentation, so verify current features and licensing.