Tool

Hidden Bee IDA loader

Hidden Bee IDA loader imports the malware family's stripped-down PE-like payload format into IDA for binary analysis. It creates segments, assigns import names and types, and processes relocation information so the database can be rebased. The author also documents examining IDA's pe.dll loader to work out its import and relocation handling.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

Prerequisites: IDA with IDAPython and the pefile Python module is required.
Scope: The loader targets the Hidden Bee custom payload format.
License: No licence stated on the project page.

Cite

BibTeX

@misc{hidden-bee-ida-loader,
  title = {{Hidden Bee IDA loader}},
  howpublished = {\url{https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family}},
  url = {https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family},
  urldate = {2026-11-09},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/hidden-bee-ida-loader/}}
}

Plain text

Hidden Bee IDA loader. https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family (accessed 2026-11-09). Awesome REA entry: https://awesomerea.org/resources/hidden-bee-ida-loader/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family