Go to file

Alberto Ortega 809db9b09b make cppcheck happy, fixes 3 of: (style) Variable xxx is assigned a value that is never used.		2015-04-08 19:30:08 +02:00
pafish	make cppcheck happy, fixes 3 of: (style) Variable xxx is assigned a value that is never used.	2015-04-08 19:30:08 +02:00
screenshots	Added v02 screenshots	2012-10-28 19:06:09 +01:00
.gitignore	house-keeping	2015-01-01 17:17:06 +01:00
CHANGELOG	Bump v05	2015-03-20 18:22:03 +01:00
LICENSE.txt	Added LICENSE.txt	2013-03-23 18:03:28 +01:00
README.md	Update readme, remove dead link, the production build wont be signed from now	2015-03-20 14:58:12 +01:00
pafish.exe	Bump v05	2015-03-20 18:22:03 +01:00

README.md

Pafish

(Paranoid Fish)

Pafish is a demo tool that performs some anti(debugger/VM/sandbox) tricks. Most of them are often used by malware to avoid debugging and dynamic analysis.

The project is open source, you can read the code of all anti-analysis checks. You can also download the compiled executable (or compile it by yourself) and reverse engineer it, which is quite recommended.

It is licensed under GNU/GPL version 3.

Scope

Note that the aim of the project is not to implement complex VM detections.

The objective of this project is to collect usual tricks seen in malware samples. This allows us to study them, and test if our analysis environments are properly implemented.

Examples of execution (v025 all of them):

ThreatExpert
Cuckoo Sandbox
Anubis
Comodo

Build

Pafish is written in C and built with pure MinGW (make + gcc).

Author

Alberto Ortega (@a0rtega - profile)

Contributions

Feel free to send me malware samples or more tricks to add. GPG ID: 6A06CF5A