1.0 Beta 1.1

Changes

• Bug fix of Shannon entropy for sections

1.0 Beta 1

Changes

• robustness for corkami's PoC binaries (thanks Ange Albertini) and ca 100000 Virusshare binaries
• lots of anomalies added for detection (77 different anomalies by now)
• delay-load imports added
• delay-load imports in Visualizer
• hash, debug and relocs added to reportcreator output
• FileTypeScanner added (still experimental)
• cofoja removed
• Visualizer refactoring --> API change, use VisualizerBuilder now to craft your Visualizer instance
• Hasher interface change: takes MessageDigest instance

1.0 Alpha 7

Changes:

• Relocations parsing
• MD5 and SHA256 calculation for sections and files
• Resource loop detection and robustness
• Anomaly detections added:
  • shuffled sections
  • fractionated data directories
  • invalid data directory entry
  • reserved MSDOS fields
  • Kernel32.dll imports by ordinal
  • entry point in writeable header
• Report creator added
• Additional MSDOS Header fields
• Local entropy calculation
• Visualizer update with local entropy and relocations
• Anomaly API overhaul
• Fractionated data directory robustness
• Ordinal imports
• PE parts loaded in chunks for speed improvement

1.0 Alpha 6

Changes:

• shannon entropy calculation for sections, byte arrays or whole files
• anomaly-statistics based detection heuristic
• anomaly subtypes added
• subsystem additions
• rudimentary : exception section
• null completely removed as return type

1.0 Alpha 5

Changes

• API changes (to avoid null, better method names, better interfaces)
• PE Visualizer
• more anomalies recognized

1.0 Alpha 4

1.0 Alpha 4

Features

• Reading header information from: MSDOS Header, COFF File Header, Optional Header, Section Table
• Reading standard section formats: Import Section, Resource Section, Export Section, Debug Section
• Dumping of sections, overlay, embedded ZIP, JAR or .class files
• Scanning for file anomalies in the PE Headers: including collapsed headers and usage of deprecated, reserved or wrong values
• Scan for PEiD signatures or your own signature database
• Scan for jar2exe or class2exe wrappers
• Overlay detection