Malware & Forensics¶ Pull static/behavioral capabilities out of a sample, or carve evidence off a disk image. CAPA¶ binary Identifies capabilities (persistence, C2, etc.) in a binary automatically. FLOSS¶ binary Extracts obfuscated/stacked/encoded strings malware tries to hide. Detect It Easy (DIE)¶ app Identifies file types, packers, and compilers at a glance. PEStudio¶ staged Static triage for Windows PE files — Windows-only, staged for that VM. CyberChef¶ offline The "cyber Swiss Army knife" for decoding/transforming data — runs fully offline. Binwalk¶ system Finds and extracts embedded files/firmware inside a binary blob. Autopsy / Sleuth Kit¶ system Disk-image forensics — GUI (Autopsy) over the Sleuth Kit's CLI tools.