Malcat 0.9.8
Malcat is a feature-rich hexadecimal editor / disassembler for Windows and Linux targeted to IT-security professionals. Inspect more than 50 binary file formats, disassemble and decompile different CPU architectures, extract embedded files and scan for Yara signatures or anomalies in a fast and easy-to-use graphical interface. Don't like what you get? Malcat is also heavily customizable and scriptable using python.
Malcat has been designed for malware analysts, SOC operators, incident responders, CTF players or more generally anyone who needs to inspect unknown binary files on a regular basis.
Malcat has been designed for malware analysts, SOC operators, incident responders, CTF players or more generally anyone who needs to inspect unknown binary files on a regular basis.
Features
Rapid analysis
Because Malcat does not run heavy analyses like VSA or type recovery, it can analyze most files under a second. This makes it the perfect tool for quick inspections or malware triage.
Disasm & decompile
Inspect code for architectures used in malware: x86/x64, .NET, python 2 and 3, VB p-code, NSIS vm, AutoIT and Office macros.
Malcat also embedds the Sleigh decompiler for x86 and x64.
Embedded files
Leveraging its 50+ file format parsers, malcat can extract sub-files from archives and identify embedded objects within any file. A very useful feature for incident response and malware analysis.
Smart visualization
Malcat offers many view modes to focus on all aspects of the file. Inspect binary structures, naviguate through the CFG or have a higher-level look at the anomalies, you chose. You can also try our new DNA view!
Compare binaries
Compare two files side by side and inspect their structural differences using Myers algorithm, a powerful diff method used in bioinformatics which produce human-readable results and can realign.
Anomaly scanner
Highlight suspicious patterns using Yara (featuring an embedded editor), Fireeye's Capa or Malcat's own anomaly scanner which scans for more than 200 anomalies using the complete analysis results.
Kesakode database
Leveraging a database of 2000+ malware families and millions of clean + library files, our Kesakode hash lookup service can help you identify malware, write better Yara rules and speed up your RE game.
Advanced editing
Patch your file using the inline structure editor or using python.
Dealing with encrypted or encoded content? Just select the data and chose between dozens of decryption and decoding algorithms.
Known patterns
Malcat recognize and highlight more than 400000 standard strings and numerical constants and support FLIRT signatures. You can also scan a corpus of local files or check online intelligence services.
Extract strings
Malcat features different algorithms to identify both static strings and dynamic strings (e.g. stack strings).
Strings are then weighted and sorted by score to give you the most pertinent results first.
Powerful UI
Enjoy a modern and responsive UI featuring HiDPI and full unicode support (hi .NET obfuscators :).
Want to go fast? You can navigate through the analysis using numerous keyboard shortcuts.
Make it your own
It is quite easy to extend malcat or automate file analysis by using the powerful (headless) python bindings.
You can create new file type parsers, decryption routines or add new anomalies with ease.
Because Malcat does not run heavy analyses like VSA or type recovery, it can analyze most files under a second. This makes it the perfect tool for quick inspections or malware triage.
Disasm & decompile
Inspect code for architectures used in malware: x86/x64, .NET, python 2 and 3, VB p-code, NSIS vm, AutoIT and Office macros.
Malcat also embedds the Sleigh decompiler for x86 and x64.
Embedded files
Leveraging its 50+ file format parsers, malcat can extract sub-files from archives and identify embedded objects within any file. A very useful feature for incident response and malware analysis.
Smart visualization
Malcat offers many view modes to focus on all aspects of the file. Inspect binary structures, naviguate through the CFG or have a higher-level look at the anomalies, you chose. You can also try our new DNA view!
Compare binaries
Compare two files side by side and inspect their structural differences using Myers algorithm, a powerful diff method used in bioinformatics which produce human-readable results and can realign.
Anomaly scanner
Highlight suspicious patterns using Yara (featuring an embedded editor), Fireeye's Capa or Malcat's own anomaly scanner which scans for more than 200 anomalies using the complete analysis results.
Kesakode database
Leveraging a database of 2000+ malware families and millions of clean + library files, our Kesakode hash lookup service can help you identify malware, write better Yara rules and speed up your RE game.
Advanced editing
Patch your file using the inline structure editor or using python.
Dealing with encrypted or encoded content? Just select the data and chose between dozens of decryption and decoding algorithms.
Known patterns
Malcat recognize and highlight more than 400000 standard strings and numerical constants and support FLIRT signatures. You can also scan a corpus of local files or check online intelligence services.
Extract strings
Malcat features different algorithms to identify both static strings and dynamic strings (e.g. stack strings).
Strings are then weighted and sorted by score to give you the most pertinent results first.
Powerful UI
Enjoy a modern and responsive UI featuring HiDPI and full unicode support (hi .NET obfuscators :).
Want to go fast? You can navigate through the analysis using numerous keyboard shortcuts.
Make it your own
It is quite easy to extend malcat or automate file analysis by using the powerful (headless) python bindings.
You can create new file type parsers, decryption routines or add new anomalies with ease.
Screenshots
Homepage | What's New
OS: Windows 7 / 8 / 8.1 / 10 / 11 (x86-x64)
Language: ENG
Medicine: Keygen by Dr.FarFar
Size: 498,61 MB.
Download From Homepage
Installer
Login or register to see spoiler's content
Login or register to see spoiler's content
No comments