What is Freki?
Freki is a free and open-source malware analysis platform. It was built to facilitate malware analysis and reverse engineering. It also provides a REST API, so you can query and use it in different projects.
Freki now available in Github also refer Online Documentation for more info.
Important Features:
The current version of Freki supports the following features:
Hash extraction:
Hashes are the products of cryptographic algorithms designed to produce a string of characters. While comparing to MD5 & SHA-1 there’s some occurrence of collision in the results, For example, A safe file and a malicious file that result with the same MD5 or SHA-1 hash. In order to avoid this, you should prefer SHA-256 whenever possible.
Types: MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, and SSDEEP.
VirusTotal API queries:
VirusTotal API helps us to upload and scan files or URLs, IP addresses, and Domain Hashes. Once the scanning finished scanned reports and make automatic comments without the need of using the website interface. With that report, we can able to see the File properties, History like the creation of the file, etc., Although it’s a great tool for analyzing different files, it has some limitations like you need to pay for downloading samples.
Download samples for free:
In Freki, We don’t want to pay for downloading samples.
Static analysis of PE files:
The static analysis consists of examining, without executing the given samples and viewing the actual instructions. It’s used to determine whether a file is malicious, provide information about its functionality, and sometimes provide information that will allow you to produce simple network signatures. It consisting of Headers, sections, imports, capabilities, and strings.
Pattern matching with Yara:
YARA is a pattern matching framework that helps us to identify malicious content by defining complex patterns and signatures. The target can be a file, a folder, or a process. Rule files can be passed directly in source code form or can be previously compiled with the yarac tool.
Web interface and REST API:
REST API (Representational State Transfer) is a standardized architecture style for creating a Web Service API. Web service is used for REST, SOAP, and XML-RPC for communication. Simply it’s the utilization of HTTP methods to make a request over a network. For Example, One or more URL endpoints with a domain, port, path, and query string.
