# String Intelligence Analyzer — Offline Malware Analysis (Static) Tool
[](LICENSE)
[](https://www.python.org/downloads/)
[](#)
[](https://github.com/reshot2005/secintel-core)
[](https://github.com/reshot2005/string-intelligence-analyzer)
> **Extract and classify strings — URLs, IPs, paths, registry keys — malware string intelligence for IOC discovery offline.**
**Category:** Malware Analysis (Static)
**Collection phase tool:** 4/8
**Schema:** [secintel-core](https://github.com/reshot2005/secintel-core) v1
**Repository:** https://github.com/reshot2005/string-intelligence-analyzer
**Author account:** [reshot2005](https://github.com/reshot2005)
## Why String Intelligence Analyzer ranks for security search
String Intelligence Analyzer is an **offline-first**, research-grade **malware analysis (static)** utility designed for practitioners who need reproducible analysis without uploading sensitive artifacts to SaaS scanners. It emits structured findings through the shared **secintel** evidence taxonomy (OBSERVED / DERIVED / INFERRED / CORRELATED / VERIFIED) so results are auditable, exportable, and CI-friendly.
### Primary SEO keywords
`malware strings, IOC extraction strings, URL string analysis, registry key strings, binary strings`
### Topics
`malware-analysis` `reverse-engineering` `static-analysis` `cybersecurity` `threat-intelligence` `ioc` `security-tools` `python` `offline-security` `yara` `strings` `iocs`
## What problem does this solve?
Extract readable strings and classify them into useful IOC categories like URLs, IPs, paths, and registry keys.
Classification-focused string intel vs raw strings.exe.
## Key features
- String extraction
-
URL/IP/path/registry classification
-
IOC-oriented output
-
Static analysis safe
-
Exportable intelligence
- Pull C2 URLs from binaries
-
Seed IOC lists
-
Support RE notes
- Security engineers & AppSec / NetSec specialists
- SOC / DFIR / malware analysts (as applicable)
- Bug bounty hunters and penetration testers
- DevSecOps teams needing offline/air-gapped tooling
- Students and researchers learning malware analysis (static)
git clone https://github.com/reshot2005/string-intelligence-analyzer.git cd string-intelligence-analyzer python3.12 -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\Activate.ps1 pip install -e ../secintel-core # or: pip install -e git+https://github.com/reshot2005/secintel-core.git#egg=secintel-core pip install -e ".[dev]" string-intelligence-analyzer analyze sample_data --json string-intelligence-analyzer analyze sample_data --html report.html string-intelligence-analyzer version
string-intelligence-analyzer analyze sample_data \ --json --html report.html --csv findings.csv --sarif results.sarif
- Findings follow secintel classification rules (confidence only where schema allows).
- Provenance includes tool version, config hash, and input integrity metadata.
- Set
SECINTEL_SOURCE_DATE_EPOCHfor deterministic timestamps in CI.
export SECINTEL_SOURCE_DATE_EPOCH=1704067200 string-intelligence-analyzer analyze sample_data --jsonruff check src tests mypy src pytest
Browse more offline security research tools by reshot2005: network security, web AppSec, DevSecOps, digital forensics, and static malware analysis — each in its own public repository with the same secintel reporting contract.
MIT — free for research, education, and commercial use with attribution preserved.
String Intelligence Analyzer (string-intelligence-analyzer) — Extract and classify strings — URLs, IPs, paths, registry keys — malware string intelligence for IOC discovery offline. Search terms: malware strings, IOC extraction strings, URL string analysis, registry key strings, binary strings. Open-source, MIT-licensed, Python 3.12, offline cybersecurity tool by reshot2005.