Automated Malware Analysis

[imported_anubis2k7]

Any suggestions on an automated static binary/malware analyzer? Kinda like automating basic IDAPro evaluations. On a basic level, dumping strings comparing blocks, etc. More advanced features could be i.e. evaluating program branches, comparing execution flow. Would there be an easy way/method to compare two binaries and be able to definatively say how much in common code both had?

I guess something like ZeroWine only using a static analysis would be good.

thnx

[KMDave]

Not sure, if that is what you are looking for, but I recently found this tool.

[prowl3r]

I've not used it but many forensics guys seem to appreciate Responder, by HBGary. (Commercial and expensive stuff, field and pro versions).

Forensic Incident Response: Responder Pro - A review

[Metahuman]

In addition to "Buster", you might also take a look at tools like PEiD, Quick Unpack, TitanEngine, or even better - Ether which are all featured at pentestit.com. Yes I am the owner.

I prefer PEiD to detect, then use TitanEngine/Ether to actually work.