Static Analysis
| Tool | Description | Source |
|---|---|---|
file | Identify file type by magic bytes | built-in |
strings | Extract printable strings | built-in |
xxd | Hex dump files | built-in |
diec / die | Detect packers, compilers, protectors | pre-installed |
FLOSS | Extract obfuscated + stack strings | pre-installed |
CAPA | MITRE ATT&CK capability detection | pre-installed |
pescanner | PE header and section analysis | pre-installed |
exiftool | File metadata extraction | pre-installed |
binwalk | Embedded file extraction | pre-installed |
upx | UPX packer detection / unpacking | pre-installed |
Office Document Analysis
| Tool | Description | Source |
|---|---|---|
olevba | VBA macro extraction and analysis | pre-installed |
oleid | OLE file indicator detection | pre-installed |
oledump | OLE stream dumping | pre-installed |
mraptor | Malicious macro detection | pre-installed |
ViperMonkey | VBA macro emulation | install |
Script Deobfuscation
| Tool | Description | Source |
|---|---|---|
synchrony | JavaScript deobfuscation (obfuscator.io) | install |
js-beautify | JavaScript formatting and beautification | install |
ELF / Linux Analysis
| Tool | Description | Source |
|---|---|---|
readelf | ELF header and section analysis | built-in |
objdump | Disassembly and symbol inspection | built-in |
nm | Symbol table listing | built-in |
ldd | Shared library dependencies | built-in |
strace / ltrace | System and library call tracing | pre-installed |
Python Malware
| Tool | Description | Source |
|---|---|---|
pyinstxtractor-ng | Unpack PyInstaller bundles | pre-installed |
uncompyle6 | Decompile Python .pyc bytecode | install |
Windows Installer (MSI / MSIX)
| Tool | Description | Source |
|---|---|---|
msiextract | Extract MSI file contents | pre-installed |
msidump | Dump MSI database tables | pre-installed |
7z / unzip | Extract MSIX/AppX packages | pre-installed |
cabextract | Extract Cabinet files | pre-installed |
.NET Assembly Analysis
| Tool | Description | Source |
|---|---|---|
ilspycmd | Decompile .NET assemblies to C# source | pre-installed |
monodis | Disassemble .NET IL bytecode, extract user strings | pre-installed |
pedump | PE/CLI header and metadata table analysis | pre-installed |
dnfile | Python library for .NET metadata parsing | install |
pefile | Python PE structure parsing library | install |
dotnet 8.0 runtime | Required by ilspycmd | pre-installed |
Java / JAR Analysis
| Tool | Description | Source |
|---|---|---|
cfr | Decompile JAR/class to Java source — handles modern Java well | pre-installed |
procyon | Alternative Java decompiler — better with obfuscated code | pre-installed |
javap | Disassemble .class bytecode to JVM instructions | built-in |
jadx | Decompile JAR and Android APK — best for obfuscated JARs | pre-installed |
java / jar | JDK tools for manifest inspection and class listing | built-in |
jadx is at /usr/local/jadx/bin/jadx on REMnux — it is not in PATH by default.Go Binary Analysis
| Tool | Description | Source |
|---|---|---|
go version -m | Extract build info and module dependencies from Go binary | install |
blint | Go binary capability detection — MITRE ATT&CK mapping | install |
nm / objdump | Symbol extraction — Go symbols are rarely stripped | built-in |
strings | Go binaries embed module paths unobfuscated — very effective | built-in |