Analyzes malicious ISO, IMG, VHD, and similar container files used to smuggle payloads past email and mark-of-the-web defenses by enumerating contents and flagging hidden executables, LNKs, and scripts. Activates for requests to analyze a malicious ISO/IMG, inspect a container delivery file, or find payloads hidden inside a disk image attachment.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Do not use mounting/auto-run to inspect — that can trigger the lure. Parse the container's directory records statically.
pycdlib for full ISO parsing (the script falls
back to signature/string carving if absent).python scripts/analyst.py inspect sample.iso
Detects ISO 9660 (CD001), UDF, FAT/VHD signatures and reports the format.
Lists embedded file signatures (MZ, PK, LNK \x4C\x00\x00\x00, script headers) and flags
hidden/executable/decoy entries.
A typical chain is a visible LNK pointing at a hidden DLL/EXE/script in the same image — document the relationship.
Carve the hidden payload and route it to the appropriate analysis workflow; defang URLs.
references/api-reference.md for the inspector.아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Analyzes cryptojacking/coinminer malware by extracting mining pool endpoints (stratum), wallet addresses, algorithm and miner identifiers (XMRig and forks), and persistence or resource-control settings from static strings and config. Activates for requests to analyze a cryptominer, extract mining pool and wallet IOCs, or identify coinminer configuration.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.