Loading...

Plugin that decompiles malware PE files into readable C code using hybrid analysis.
Plugin that decompiles malware PE files into readable C code using hybrid analysis.
Joe Sandbox DEC is a decompilation plugin for the Joe Sandbox product family that converts malware binaries into readable C code using a technique called Hybrid Decompilation. The tool operates on unpacked PE files extracted directly from process memory dumps. It applies static decompilation techniques while incorporating dynamic analysis data from Hybrid Code Analysis (HCA) to improve and extend the decompilation output. Key capabilities include: - Reconstruction of function prototypes and local variables from raw disassembly - Generation of high-level control structures (if, switch/case, do/while/for loops) from low-level jumps and comparisons - Recovery of high-level type information using an extensive database of Windows API types and function prototypes - Resolution of indirect function calls using dynamic data from Hybrid Code Analysis - Annotation of generated C code with runtime comments (e.g., statement execution status, variable runtime values) The decompilation process is fully automatic and produces C code that is embedded directly into the Joe Sandbox behavior report. Joe Sandbox DEC is designed to reduce the time analysts spend reviewing raw disassembly by providing an equivalent, higher-level C code representation of malware samples. It functions as a plugin and is compatible with Joe Sandbox Desktop, Joe Sandbox Light, and Joe Sandbox Ultimate.
Common questions about Joe Sandbox DEC including features, pricing, alternatives, and user reviews.
Joe Sandbox DEC is Plugin that decompiles malware PE files into readable C code using hybrid analysis. developed by Joe Security. It is a Security Operations solution designed to help security teams with Reverse Engineering, Dynamic Analysis, Binary Analysis.
Agentic AI tool for automated malware reverse engineering & phishing analysis.
Get strategic cybersecurity insights in your inbox
A command-line tool for analyzing and extracting detailed information from Windows Portable Executable (PE) files.
A static analysis tool for PE files that identifies potential malicious indicators through compiler detection, packing analysis, signature matching, and suspicious string identification.
A .NET assembly debugger and editor that enables reverse engineering and dynamic analysis of compiled .NET applications without source code access.