🧪 Weekly Malware Reports

Welcome to the MalwareHound project — a personal initiative to reverse engineer and analyze one malware sample per week. This repository includes static and dynamic analysis, behavioral breakdowns, YARA rules, and professional-grade reports in PDF format.

Goal: Sharpen malware analysis skills through weekly hands-on work and contribute to the community's collective knowledge.

---

📄 Reports

Date	Malware Name	Type	PDF Report	YARA
2025-07-01	PDF.Dropper.EncShell.pdf	embedded/encrypted shell	📄 Report	🧬 Rule
2025-06-24	LNK.APT.ZeroDayLoader	LNK / .NET Reflective	📄 Report	🧬 Rule
2025-06-18	SyntheticHijacker	Persistence Hijacker	📄 Report	🧬 Rule

More reports will be added. Stay tuned!

---

🧰 Tools Used

• YARA — Pattern-matching engine for malware signatures
• Detect It Easy (DIE) — Static file type and packer detection
• dnSpyEx — .NET debugger and decompiler
• ILSpy — .NET assembly browser and decompiler
• x64dbg — Debugger for Windows executables
• Ghidra — Disassembler and decompiler for reverse engineering
• Wireshark — Network protocol analyzer
• Procmon (Process Monitor) — Runtime system activity monitor
• Process Hacker — Advanced process viewer
• Capa — Identifies capabilities in executables
• CyberChef — Cyber Swiss army knife for data transformation
• UPX — Executable packer/unpacker
• PE-bear — PE structure inspection and patching
• REMnux — Malware analysis Linux distro
• FLARE-VM — Malware analysis Windows VM setup
• INetSim — Simulates internet services in an isolated network
• MobSF (Mobile Security Framework) — APK static analysis
• Cutter — GUI frontend for Radare2, used for disassembly and analysis
• Fakenet-NG — Simulated network services for malware behavior monitoring

---

📁 Structure

MalwareHound/
├── README.md
├── reports
│   ├── LNK.APT.ZeroDayLoader.pdf
│   ├── PDF.Dropper.EncShell.pdf
│   └── SyntheticHijacker-Report-PMAT.pdf
├── SyntheticHijacker-Report-PMAT.pdf
└── yara
    ├── LNK.yara
    ├── pdf-loader.yara
    └── SyntheticHijacker.yara

---

🔐 Disclaimer

This repository is created for educational and research purposes only.
Do not attempt to reuse or repackage the information for malicious purposes.
The author is not responsible for any misuse of the data or code shared.

---

👨‍💻 Author

Hackering True
Cybersecurity Researcher & Malware Analyst
🌐 GitHub Profile
💼 LinkedIn

---