hasherezade

PE-bear (builds only)

hasherezade

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

hasherezade

IFL - Interactive Functions List (plugin for IDA Pro)

hasherezade

My implementation of enSilo's Process Doppelganging (PE injection technique)

hasherezade

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

hasherezade

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

hasherezade

Dynamic unpacker based on PE-sieve

hasherezade

Set of antianalysis techniques found in malware

hasherezade

Converts a EXE into DLL

hasherezade

Various snippets created during malware analysis

hasherezade