Tessera
Folgen

clibm079

@clibm079.bsky.social

Independent Malware Analyst & Researcher,Notes (Philosophy & Poetry) — The Path of Clarity & Poems of Malware Analysis. Blog: https://malwareanalysisspace.blogspot.com Website: https://clibm079.net

23 Posts6 Follower9 Folgt
clibm079@clibm079.bsky.social · 7mo ago

Example: tiny_tracer & IFL: strengthening first-view and function-level malware analysis From trace-driven execution to fine-grained IDA supplementation 💙

clibm079@clibm079.bsky.social · 9mo ago

Example: PE-Bear: Visualize DLL Side-Loading and Sample Correlation Practical and convenient for observing malware correlations in a single window. Also valuable for incident response and IoC collection.

clibm079@clibm079.bsky.social · 9mo ago

Example: PE-Bear + DIE: Fast Shows Structural Evolution — and What It’s Changed. Compare Mode is ideal for comparing related samples in a malware family. This helps you trace the malware evolution and also study the PE structure with a GUI.

clibm079@clibm079.bsky.social · 9mo ago

Example: PE-Bear + DIE: Fast Pack Check — and Why It’s Packed. Combine this with other skills, like strings scanning and experience-based analysis. This helps you decide the next step: sandbox, unpack, or reverse engineer.

clibm079@clibm079.bsky.social · 9mo ago

PE-bear provides rapid string scanning and plaintext visibility inside suspicious binaries. Like DiE and Malcat Lite, it’s an effective first-step triage tool for malware such as ransomware — a quick way to spot early indicators before diving deeper into reverse engineering.

clibm079@clibm079.bsky.social · 10mo ago

I used PE-bear for the first time to dump an embedded binary. Its intuitive UI made extraction effortless. Because malware often embeds payloads with the form A in B to evade detection, pulling out the inner binary was crucial for deeper analysis and IoCs hunting.