- IDA_nymaim_func_unwrap.py: IDA script to deobfuscate Nymaim funcion call wrappers
- nymaim_rz_deobfuscate.py: Rizin script to deobfuscate Nymaim funcion call wrappers and register-push obfuscation
- nymaim_hasher.py: Script to generate a dictionary with Nymaim's hashed strings using Rizin emulation
- Make
nymaim_hasher.py
generic to parse any sample. Currently, it only works with samplea7370aa2833a7b4178b6494941aa5a9b31fef6b18c7cfa025ec2100d89132bc0