ConventionEngine is a collection of Yara rules designed to analyze Portable Executable (PE) files by examining their Program Database (PDB) paths for suspicious characteristics. The tool focuses on identifying PEs that contain PDB paths with unique, unusual, or overtly malicious-looking keywords, terms, or other anomalous features that may indicate malicious intent or unprofessional development practices. The analysis framework categorizes findings into three main areas: - Keywords: String words used by malware developers to organize files, folders, and code projects that often describe malware functionality - Terms: String words appearing in paths that result from operating system, software, or user behavior, potentially indicating solo development or non-enterprise software projects - Anomalies: Less common but suspicious indicators of various malicious behaviors The tool leverages research and methodologies documented in FireEye blog series and accompanying documentation, providing a systematic approach to identifying potentially malicious executables through PDB path analysis.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
An open source .NET deobfuscator and unpacker that restores packed and obfuscated assemblies by reversing various obfuscation techniques.
A binary analysis and management framework for organizing and analyzing malware and exploit samples, and creating plugins.
Joe Sandbox Community provides automated cloud-based malware analysis across multiple OS platforms.
Valkyrie is a sophisticated file verdict system that enhances malware detection through behavioral analysis and extensive file feature examination.
An open-source dynamic analysis framework that intercepts and monitors API calls in Android applications using the Android Substrate framework.
A .NET assembly debugger and editor that enables reverse engineering and dynamic analysis of compiled .NET applications without source code access.
A tool that extracts and deobfuscates strings from malware binaries using advanced static analysis techniques.
A collaborative malware analysis framework with various features for automated analysis tasks.