4n4lDetector Pro - Version 2025

Innovations - Unique Technical Features

Below is a breakdown of the unique innovations and their functionalities:

Innovation	Description
Intelligent String	Removes noise and prioritizes relevant IOCs to generate useful rules.
Flow Anomalies Heuristics	Detects advanced evasion techniques at the assembly level, including abnormal control flow, payloads, suspicious jumps, code caves, junk code patterns, TLS callbacks.
1-Click YARA Rules	Complete rules including ASCII/Unicode strings, hex patterns, anomalous resources, Entry Point, and exported function content.
Advanced Carving	Extracts embedded PE headers and applies a proprietary method to locate export tables without header pointers.
Full Support	Compatible with 32/64-bit (8086, x86, AMD64, ARMv7/ARMv8) and formats: .exe, .dll, .sys, .ocx, .scr, .drv, .cpl.
Operational Flexibility	CLI, GUI, and web platform integrated; selective module activation as needed.
Offset Finder + Integrated Disassembler	Precise offset search with automatic disassembly/visualization in the detected architecture.
Analyze Any File	Not limited to PE; adaptive engines and modules handle multiple content types.
Microsoft Rich Signature Anomaly Detection	Searches for inconsistencies and anomalies in Microsoft Rich signatures to detect tampering, repacking or automated build artifacts used by malware.
Structured Tagging of Binary Data	Organizes all de-structured binary information into well-defined tags (strings, imports, exports, resources, heuristics) to enable fast filtering, correlation and rule generation.

Purchase

Below is a breakdown of the available packages:

Number of Scans	Price	Details
4n4lDetector Pro 2025	€120	One-year license for a single machine
4n4lDetector Pro 2025 200 Scans Private API Report	€130	A one-year license for a single machine, including 200 scans via PEscan.io with Private API reports

Delivery

After completing the payment, the download link for your private version of 4n4lDetector Pro will be sent to the email address provided during the purchase process.

Video Demo

Pro Features

• Exclusive YARA rule creation:
• Rules generated directly with automatic verification.
• Intelligent String in ANSI and Unicode with proper declarations.
• Inclusion of Entry Point, overlay data, and executable code extracted from Export Table functions.
• Detection of malicious resources integrated into rule creation.
• Interest Words are also used to automatically generate additional YARA rules.
• Extended Detection Coverage:
• +5,300 new detections for known malware entry points.
• Total database expanded to approximately 10,000 rules.
• Hash Intelligence Integration:
• Hashes verified against the pescan.io database.
• Clicking on the green check icon opens the online report when available.
• Gamification & Customization:
• Unlocks the internal medal system.
• Access to the complete set of Interest Words from the module.
• Includes exclusive styles and visual themes.

Platinum Upgrade and UI Enhancements

We have enhanced the professional version while retaining the medal system. In the free edition, the medal tiers function as a symbolic gameplay element, while in the Pro edition users are automatically upgraded to the Platinum tier with all advantages fully unlocked. Beyond the redesigned color scheme for the main interface, the Pro version grants exclusive access to the complete unlocking of words from the “Words of Interest” section, together with the unique ability to generate YARA rules, a feature available only to Pro users.

Additionally, we have included a Complete Word Search functionality, which can be accessed directly from the Settings section of the tool. This new feature allows users to perform more accurate and comprehensive searches for malware signatures or key terms within the analyzed files.

Advanced Static Analysis Tool

4n4lDetector is a scan tool for Microsoft Windows executables, libraries, drivers, and memory dumps. Its main objective is to collect the necessary information to facilitate the identification of malicious code within the analyzed files. This tool analyzes, among other things, the PE header and its structure, the content of the sections, the different types of strings, and many other aspects. It also incorporates a multitude of its own ideas to recognize anomalies in file construction and detect mechanisms used by modern malware.

Using the tool is simple: just configure the options in the dropdown panel on the right and drag the samples into 4n4lDetector.

Full Support

• 32-bit (8086, x86, ARMv7)
• 64-bit (AMD64, x86-64, x64, ARMv8)

IT and ET Extraction

• Alpha AXP, ARM, ARM Thumb-2 (32-bit Thumb), ARM64, EFI Byte Code, EFI Byte Code (EBC), Hitachi SH3, Hitachi SH3, Hitachi SH4, Hitachi SH5, Intel i860, Intel Itanium (IA-64), M32R, MIPS16, MIPS16 with FPU, MIPS R3000, MIPS R4000, MIPS with FPU, MIPS little-endian, MIPS little-endian WCE v2, x64, x86, x86-64.

Buttons Code

• Green buttons are action buttons that open files and folders or interact with the tool's utilities.
• Red buttons perform reconfigurations, delete data, or reset functional files.
• Purple buttons announce the activation of online interactions.
• Pink buttons are shortcut tabs to navigate between different types of utilities.

PE Chart Code

• Executable header is Light Blue.
• Executable sections are Pink.
• Non-executable sections are Black.
• Code added externally to a compiler appears in Red (Crypters, Joiners, Droppers...)

Chart code for other files

• Printable characters are Light Blue.
• Non-printable characters (Null Bytes) are Black.

Console Options (Analysis to File)

• Start the graphical interface parsing a file from the console:
4n4lDetector.exe Path\App.exe -GUI
• Remove binary after scan:
4n4lDetector.exe Path\App.exe -GREMOVE
• Parse a file from the console and the output is written to a TXT file:
4n4lDetector.exe Path\App.exe -TXT
• Parse a file from the console and the output is written to HTML file:
4n4lDetector.exe Path\App.exe -HTML

Detections

• PE Information, Unusual Entry Point Position or Code (Algorithms, Anomalous Instructions... ), Packers, Compilations, Binders/Joiners/Crypters, Architectures, Possible malicious functions, Registry Keys, Files Access, Juicy Words, Anti-VM/Sandbox/Debug, URLs Extractor, Payloads, AV Services, Duplicate Sections, IP/Domains List, Config RAT (Only In Memory Dumps), Call API By Name, Unusual Chars In Description File (Polymorphic Patterns), Rich Signature Analyzer, CheckSum Integrity Problem, PE Integrity Check, SQL Queries, Emails, Malicious resources, PE Carve, Exploits, File Rules for Entry Points and more...

More Information

• For further information regarding the project, please visit our Blog and Github repository.