Qu1cksc0pe

All-in-One malware analysis tool for analyze Windows, Linux, OSX binaries, Document files, APK files and Archive files.

You can get:

What DLL files are used.
Functions and APIs.
Sections and segments.
URLs, IP addresses and emails.
Android permissions.
File extensions and their names.
And so on...

Qu1cksc0pe aims to get even more information about suspicious files and helps user realize what that file is capable of.

Qu1cksc0pe Can Analyze Currently

Files	Analysis Type
Windows Executables (.exe, .dll, .msi, .bin)	Static, Dynamic
Linux Executables (.elf, .bin)	Static, Dynamic
MacOS Executables (mach-o)	Static
Android Files (.apk, .jar)	Static, Dynamic(for now .apk only)
Golang Binaries (Linux)	Static
Document Files	Static
Archive Files (.zip, .rar, .ace)	Static
PCAP Files (.pcap)	Static

Usage

python3 qu1cksc0pe.py --file suspicious_file --analyze

Screenshot

Updates

13/06/2023

NEW FEATURE!!: Qu1cksc0pe can now perform large file analysis. You can now detect and extract actual malwares from large files!

large_files.mp4

12/06/2023

NEW FEATURE!!: Qu1cksc0pe can now perform PCAP analysis. You can do:
Find URL addresses
Find DNS Queries
Find interesting strings
Detect embedded executable files and extract them

pcap_analysis.mp4

Available On

Note

You can also use Qu1cksc0pe from Windows Subsystem Linux in Windows 10.

Setup and Installation

Necessary Dependencies:

VirusTotal API Key => Performing VirusTotal based analysis.
Strings => Necessary for static analysis.
PyExifTool => Metadata extraction.
Jadx => Performing source code and resource analysis.
PyOneNote => OneNote document analysis.

# You can simply execute the following command it will do everything for you!
bash setup.sh

# If you want to install Qu1cksc0pe on your system just execute the following commands.
bash setup.sh
sudo python3 qu1cksc0pe.py --install