• 0-day 1
• Adobe Flash 1
• AnalyzePDF 1
• CFF Explorer 1
• CaptureBAT 1
• ClamAV 4
• Cymru 1
• FDE 1
• HoneyD 1
• HxD 1
• INetSim 1
• JavaScript 1
• Kon-Boot 1
• MACB 3
• Malzilla 1
• OMFW 1
• OSDFC 1
• OllyDbg 1
• Ophcrack 1
• PDF 3
• REMnux 2
• SWF 1
• SafeBoot 1
• Sticky Keys 1
• ThreatExpert 1
• TrID 1
• TrIDScan 1
• VirtualBox 1
• VirusTotal 1
• WinTech 1
• XDP 1
• XOR 3
• XtremeRAT 1
• YARA 6
• ZeuS 1
• analysis 1
• anti-virus 1
• avsubmit 1
• awk 1
• bash 3
• classification 2
• commodity malware 1
• cuckoo 1
• dbmgr 1
• dfir 7
• doSWF 1
• encryption 1
• execution 1
• firewire 1
• fls 1
• forensics 2
• frequency analysis 1
• ftwautopwn 1
• grep 1
• hachoir-subfile 2
• hash 1
• inception 1
• indxparse 1
• jinja 1
• libforensic1394 1
• libpff 1
• log analysis 2
• log2timeline 1
• malware 6
• memory forensics 4
• mutant 1
• mutex 1
• pcap 1
• pdfextract 1
• pdfxray_lite 1
• peepdf 1
• perl 1
• pescanner 2
• pffexport 1
• prefetch 1
• proxy 1
• python 5
• scapy 1
• scripting 3
• sed 1
• sigtool 1
• tsk 1
• volatility 5
• xxxswf 1

0-day

• Sep 19, 2012 » SWF-ing away

Adobe Flash

• Sep 19, 2012 » SWF-ing away

AnalyzePDF

• Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface

CFF Explorer

• Jul 2, 2012 » Is that an Infection or a False Positive?

CaptureBAT

• Jul 17, 2012 » Customizing cuckoo to fit your needs

ClamAV

• Jul 17, 2012 » Customizing cuckoo to fit your needs
• Jul 2, 2012 » Is that an Infection or a False Positive?
• Jun 19, 2012 » XDP files and ClamAV
• Apr 19, 2012 » YARA + Volatility ... the beginning

Cymru

• Jul 17, 2012 » Customizing cuckoo to fit your needs

FDE

• Jun 26, 2013 » Don't Get Locked Out

HoneyD

• Jul 17, 2012 » Customizing cuckoo to fit your needs

HxD

• Jul 2, 2012 » Is that an Infection or a False Positive?

INetSim

• Jul 17, 2012 » Customizing cuckoo to fit your needs

JavaScript

• Apr 25, 2012 » Deobfuscating JavaScript with Malzilla

Kon-Boot

• Jun 26, 2013 » Don't Get Locked Out

MACB

• Mar 12, 2014 » Bruteforcing XOR with YARA
• Oct 1, 2012 » dbmgr reloaded
• Jul 17, 2012 » Customizing cuckoo to fit your needs

Malzilla

• Apr 25, 2012 » Deobfuscating JavaScript with Malzilla

OMFW

• Nov 11, 2013 » OMFW & OSDFC recap

OSDFC

• Nov 11, 2013 » OMFW & OSDFC recap

OllyDbg

• Sep 19, 2012 » SWF-ing away

Ophcrack

• Jun 26, 2013 » Don't Get Locked Out

PDF

• Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface
• Jun 21, 2012 » Getting what you want out of a PDF with REMnux
• Jun 19, 2012 » XDP files and ClamAV

REMnux

• Jun 21, 2012 » Getting what you want out of a PDF with REMnux
• Apr 19, 2012 » YARA + Volatility ... the beginning

SWF

• Sep 19, 2012 » SWF-ing away

SafeBoot

• Jun 26, 2013 » Don't Get Locked Out

Sticky Keys

• Jun 26, 2013 » Don't Get Locked Out

ThreatExpert

• Oct 1, 2012 » dbmgr reloaded

TrID

• Jun 19, 2012 » XDP files and ClamAV

TrIDScan

• Jun 19, 2012 » XDP files and ClamAV

VirtualBox

• Jul 17, 2012 » Customizing cuckoo to fit your needs

VirusTotal

• Jul 17, 2012 » Customizing cuckoo to fit your needs

WinTech

• Jun 26, 2013 » Don't Get Locked Out

XDP

• Jun 19, 2012 » XDP files and ClamAV

XOR

• Mar 12, 2014 » Bruteforcing XOR with YARA
• Jan 22, 2013 » NoMoreXOR
• Sep 19, 2012 » SWF-ing away

XtremeRAT

• Mar 12, 2014 » Bruteforcing XOR with YARA

YARA

• Mar 12, 2014 » Bruteforcing XOR with YARA
• Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface
• Jan 22, 2013 » NoMoreXOR
• Jul 17, 2012 » Customizing cuckoo to fit your needs
• Jun 19, 2012 » XDP files and ClamAV
• Apr 19, 2012 » YARA + Volatility ... the beginning

ZeuS

• Jul 2, 2012 » Is that an Infection or a False Positive?

analysis

• Feb 13, 2012 » What to use for analysis on a per file extension -or- category basis

anti-virus

• Jul 2, 2012 » Is that an Infection or a False Positive?

avsubmit

• Oct 1, 2012 » dbmgr reloaded

awk

• Jan 9, 2012 » Total number of connections to a server from proxy logs

bash

• Apr 30, 2012 » Let Me In
• Apr 19, 2012 » YARA + Volatility ... the beginning
• Jan 9, 2012 » Total number of connections to a server from proxy logs

classification

• Jun 19, 2012 » XDP files and ClamAV
• Feb 13, 2012 » What to use for analysis on a per file extension -or- category basis

commodity malware

• Jul 2, 2012 » Is that an Infection or a False Positive?

cuckoo

• Jul 17, 2012 » Customizing cuckoo to fit your needs

dbmgr

• Oct 1, 2012 » dbmgr reloaded

dfir

• Apr 18, 2014 » Rewriting/Anonymizing Artifacts
• Jun 19, 2012 » XDP files and ClamAV
• May 9, 2012 » What's in your logs?
• Apr 30, 2012 » Let Me In
• Apr 25, 2012 » Deobfuscating JavaScript with Malzilla
• Mar 26, 2012 » Making Volatility Work for You
• Feb 13, 2012 » What to use for analysis on a per file extension -or- category basis

doSWF

• Sep 19, 2012 » SWF-ing away

encryption

• Jun 26, 2013 » Don't Get Locked Out

execution

• May 10, 2016 » Go Prefetch Yourself

firewire

• Apr 30, 2012 » Let Me In

fls

• May 10, 2016 » Go Prefetch Yourself

forensics

• Apr 18, 2014 » Rewriting/Anonymizing Artifacts
• Nov 11, 2013 » OMFW & OSDFC recap

frequency analysis

• Jan 22, 2013 » NoMoreXOR

ftwautopwn

• Apr 30, 2012 » Let Me In

grep

• Jan 9, 2012 » Total number of connections to a server from proxy logs

hachoir-subfile

• Jul 17, 2012 » Customizing cuckoo to fit your needs
• Jun 21, 2012 » Getting what you want out of a PDF with REMnux

hash

• Jul 2, 2012 » Is that an Infection or a False Positive?

inception

• Apr 30, 2012 » Let Me In

indxparse

• May 10, 2016 » Go Prefetch Yourself

jinja

• May 10, 2016 » Go Prefetch Yourself

libforensic1394

• Apr 30, 2012 » Let Me In

libpff

• Jul 17, 2012 » Customizing cuckoo to fit your needs

log analysis

• May 9, 2012 » What's in your logs?
• Jan 9, 2012 » Total number of connections to a server from proxy logs

log2timeline

• May 9, 2012 » What's in your logs?

malware

• Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface
• Jan 22, 2013 » NoMoreXOR
• Jul 17, 2012 » Customizing cuckoo to fit your needs
• Jun 19, 2012 » XDP files and ClamAV
• Apr 25, 2012 » Deobfuscating JavaScript with Malzilla
• Feb 13, 2012 » What to use for analysis on a per file extension -or- category basis

memory forensics

• May 10, 2016 » Go Prefetch Yourself
• Apr 18, 2014 » Rewriting/Anonymizing Artifacts
• Nov 11, 2013 » OMFW & OSDFC recap
• Mar 26, 2012 » Making Volatility Work for You

mutant

• Oct 1, 2012 » dbmgr reloaded

mutex

• Oct 1, 2012 » dbmgr reloaded

pcap

• Apr 18, 2014 » Rewriting/Anonymizing Artifacts

pdfextract

• Jul 17, 2012 » Customizing cuckoo to fit your needs

pdfxray_lite

• Jun 21, 2012 » Getting what you want out of a PDF with REMnux

peepdf

• Jun 21, 2012 » Getting what you want out of a PDF with REMnux

perl

• Jan 9, 2012 » Total number of connections to a server from proxy logs

pescanner

• Jul 2, 2012 » Is that an Infection or a False Positive?
• Apr 19, 2012 » YARA + Volatility ... the beginning

pffexport

• Jul 17, 2012 » Customizing cuckoo to fit your needs

prefetch

• May 10, 2016 » Go Prefetch Yourself

proxy

• Jan 9, 2012 » Total number of connections to a server from proxy logs

python

• May 10, 2016 » Go Prefetch Yourself
• Apr 18, 2014 » Rewriting/Anonymizing Artifacts
• Dec 3, 2013 » AnalyzePDF - Bringing the Dirt Up to the Surface
• Jan 22, 2013 » NoMoreXOR
• Apr 19, 2012 » YARA + Volatility ... the beginning

scapy

• Apr 18, 2014 » Rewriting/Anonymizing Artifacts

scripting

• Apr 30, 2012 » Let Me In
• Apr 19, 2012 » YARA + Volatility ... the beginning
• Jan 9, 2012 » Total number of connections to a server from proxy logs

sed

• Jan 9, 2012 » Total number of connections to a server from proxy logs

sigtool

• Jul 2, 2012 » Is that an Infection or a False Positive?

tsk

• May 10, 2016 » Go Prefetch Yourself

volatility

• May 10, 2016 » Go Prefetch Yourself
• Apr 18, 2014 » Rewriting/Anonymizing Artifacts
• Nov 11, 2013 » OMFW & OSDFC recap
• Apr 19, 2012 » YARA + Volatility ... the beginning
• Mar 26, 2012 » Making Volatility Work for You

xxxswf

• Sep 19, 2012 » SWF-ing away