|
| 1 | +{ |
| 2 | + "version": 1, |
| 3 | + "description": "Feature snapshot fixtures. See README.md.", |
| 4 | + "snapshots": [ |
| 5 | + { |
| 6 | + "name": "pma01-01-dll", |
| 7 | + "sample": "Practical Malware Analysis Lab 01-01.dll_", |
| 8 | + "freeze": "pma01-01-dll.frz", |
| 9 | + "explanation": "Smallest PE 32-bit DLL in the corpus. Fast baseline for the PE DLL path through the viv backend (exports, imports, small function count).", |
| 10 | + "generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff" |
| 11 | + }, |
| 12 | + { |
| 13 | + "name": "mimikatz-exe", |
| 14 | + "sample": "mimikatz.exe_", |
| 15 | + "freeze": "mimikatz-exe.frz", |
| 16 | + "explanation": "Well-known PE 32-bit EXE with a wide variety of features. Exercises the PE EXE path through viv against a realistic, feature-dense sample.", |
| 17 | + "generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff" |
| 18 | + }, |
| 19 | + { |
| 20 | + "name": "pma21-01-exe", |
| 21 | + "sample": "Practical Malware Analysis Lab 21-01.exe_", |
| 22 | + "freeze": "pma21-01-exe.frz", |
| 23 | + "explanation": "PE 64-bit EXE. Covers amd64 disassembly distinct from the 32-bit PE fixtures above.", |
| 24 | + "generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff" |
| 25 | + }, |
| 26 | + { |
| 27 | + "name": "7351f-elf", |
| 28 | + "sample": "7351f8a40c5450557b24622417fc478d.elf_", |
| 29 | + "freeze": "7351f-elf.frz", |
| 30 | + "explanation": "ELF binary via the viv backend. Exercises the ELF loader plus OS/arch detection for non-PE samples.", |
| 31 | + "generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff" |
| 32 | + }, |
| 33 | + { |
| 34 | + "name": "1c444-dotnet", |
| 35 | + "sample": "dotnet/1c444ebeba24dcba8628b7dfe5fec7c6.exe_", |
| 36 | + "freeze": "1c444-dotnet.frz", |
| 37 | + "explanation": "Small .NET assembly. Exercises the dotnet backend (dnfile/dotnetfile), which is a completely separate extraction pipeline from viv.", |
| 38 | + "generated_at_commit": "cd07bd230e831cb216450aec98859ae1dc6b16ff" |
| 39 | + }, |
| 40 | + { |
| 41 | + "name": "mimikatz-exe-ida", |
| 42 | + "sample": "mimikatz.exe_", |
| 43 | + "freeze": "mimikatz-exe-ida.frz", |
| 44 | + "backend": "ida", |
| 45 | + "explanation": "Mimikatz via idalib. Exercises the IDA backend against the same sample as mimikatz-exe (viv), enabling cross-backend comparison.", |
| 46 | + "generated_at_commit": "dfb34f06a0826c2445a1618530d0f83566b72f7f" |
| 47 | + } |
| 48 | + ] |
| 49 | +} |
0 commit comments