PEframe - PEframe is an open source tool to perform static analysis on Portable Executable malware and malicious MS Office documents.

AnalyzePE - Wrapper for a variety of tools for reporting on Windows PE files.

Assemblyline - A scalable distributed file analysis framework.

BinaryAlert - An open source, serverless AWS pipeline that scans and alerts on uploaded files based on a set of YARA rules.

capa - Detects capabilities in executable files.

chkrootkit -- locally checks for signs of a rootkit

Chkrootkit locally checks for signs of a rootkit includes ifpromisc c to check if the interface is in promiscuous mode chklastlog c and chkwtmp c to check for lastlog and wtmp deletions and chkproc c for signs of lkm trojans

ClamAV - Open source antivirus engine.

Detect It Easy(DiE) - A program for determining types of files.

Exeinfo PE - Packer, compressor detector, unpack info, internal exe tools.

ExifTool by Phil Harvey

A command line application and perl library for reading and writing exif gps iptc xmp makernotes and other meta information in image audio and video files for windows mac os and unix systems

File Scanning Framework - Modular, recursive file scanning solution.

fn2yara - FN2Yara is a tool to generate Yara signatures for matching functions (code) in an executable program.

Generic File Parser - A Single Library Parser to extract meta information,static analysis and detect macros within the files.

hashdeep - Compute digest hashes with a variety of algorithms.

HashCheck - Windows shell extension to compute hashes with a variety of algorithms.

Loki - Host based scanner for IOCs.

Malfunction - Catalog and compare malware at a function level.

Manalyze - Static analyzer for PE executables.

MASTIFF - Static analysis framework.

MultiScanner - Modular file scanning/analysis framework

Nauz File Detector(NFD) - Linker/Compiler/Tool detector for Windows, Linux and MacOS.

nsrllookup - A tool for looking up hashes in NIST's National Software Reference Library database.

packerid - A cross-platform Python alternative to PEiD.

PE-bear

Latest release 0 5 5 28 november 2021 qt5 what it is pe bear is a freeware reversing tool for pe files its objective was to deliver fast and flexible first view tool

pev - the PE file analysis toolkit

PortEx - Java library to analyse PE files with a special focus on malware analysis and PE malformation robustness.

Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System

The Rootkit Hunter project

ssdeep - Fuzzy hashing program

totalhash.py - Python script for easy searching of the

Marco Pontello’s Home - Software - TrID

Page Redirection

Yara rules generator - Generate yara rules based on a set of malware samples. Also contains a good strings DB to avoid false positives.

Yara Finder - A simple tool to yara match the file against various yara rules to find the indicators of suspicion.