Data Visualizer

Malignant agents tend to use complex techniques of masking their malware within inconspicuous files that may end up flying under the radar of most consumer-grade antiviruses. While the regular hexadecimal-based analysis remains the de facto procedure for the vast majority of digital forensics teams, a more intuitive and faster way of examining files can be achieved through the reinterpretation of binary code in a visual format that provides the necessary cues for creating discernible patterns when comparing two seemingly similar items side-by-side.

The latter method can be carried out through a lightweight program known as Data Visualizer, which seeks to channel the core functions of the Cantor.Dust project in a more palatable Python-based package. Once downloaded, the program requires creating and activating its virtual environment, installing the dependencies listed within the appropriately named document inside its directory and then running the app script manually, all through the user’s terminal of choice. Despite its complexity, this method allows those with programming experience to make and apply changes more easily to the source code.

Selecting a file for analysis displays its binary structure in the form of dual heatmaps whose range can be altered through dedicated sliders, while the two-dimensional diagram and Hilbert curve representations make it easier for professionals in the reverse-engineering field to visualize the core structures for detailed comparisons between digital samples. Finally, the app also provides readily available hash codes for quick searches within custom malware databases when necessary.