mandiant / flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.
Apache License 2.0
6.38k stars 900 forks source link

How to check for the following file attributes? #396

Closed flamecopper closed 1 year ago

flamecopper commented 2 years ago

Hi there, What tools do I used to check for the following file attributes?

Is the file executable? -> peinfo Is the file binary? -> Ok For which architecture (x86 or x86-64) is the binary compiled? -> exeinfo Is the binary stripped of its symbol table? Can any useful strings be identified within the binary? -> strings Is there a running process associated with this binary? -> processexplorer, procmon What is the Secure Hash Algorithm (SHA) hash of the binary? -> exeinfo, peinfo Is the hash a known malicious file hash? -> exeinfo, peinfo What was the original programming language used? -> can be any Can any useful function names be identified? -> IDA, X64 DBG, X32 DBG

vm-packages commented 1 year ago

Thank you for your feedback! We've been working on major updates to FLARE VM over the last year. The now revamped FLARE VM has just been released and will make the project more open and maintainable. Please check out our blog post at https://www.mandiant.com/resources/blog/flarevm-open-to-public and give the new installation a try.

If this problem still persists with the new installation, please report:

Please note that we use this message to close all legacy issues in this repository. We look forward to your feedback and support for the next generation of FLARE VM.