Video & Animation

Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.

Analyzes encryption algorithms, key management, and file encryption

Safely monitor ransomware group Tor-hosted data leak sites (DLS) to collect and extract structured victim posting data, track group activity trends over time, and produce sector- and geography-specific ransomware risk assessments. Use when performing threat intelligence gathering on active ransomware groups or building proactive defense reporting from double-extortion leak-site activity.

URLScan.io is a free service for scanning and analyzing suspicious URLs.

Detonate malware samples in Cuckoo Sandbox to observe runtime behavior

Query the Malpedia API to look up malware family aliases and naming

Perform static analysis of malicious PDF documents using peepdf, pdfid,

Uses the Linux Audit framework (auditd) with ausearch and aureport utilities

>-

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware,

Detect kernel-level rootkits in Linux memory dumps using Volatility3

Examine Linux system artifacts (auth logs, cron/systemd persistence,

Analyzes indicators of compromise (IOCs) including IP addresses, domains,

Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,

Analyzes malicious VBA macros embedded in Microsoft Office documents

Use Sysinternals Autoruns to systematically enumerate and analyze malware

Investigate compromised Docker containers by analyzing images, layers,

Parse and analyze email headers (Received chain, Return-Path, Message-ID)

Perform static and symbolic analysis of Solidity smart contracts using

>-

Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo

Detect and analyze heap spray attacks in memory dumps using Volatility3

Detect dangerous ACL misconfigurations in Active Directory using ldap3

Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.