{
  "added_at": "2026-11-09",
  "category": "native-analysis",
  "description_en": "Hidden Bee IDA loader imports the malware family's stripped-down PE-like payload format into IDA for binary analysis. It creates segments, assigns import names and types, and processes relocation information so the database can be rebased. The author also documents examining IDA's pe.dll loader to work out its import and relocation handling.",
  "description_zh": "Hidden Bee IDA 加载模块将该恶意软件家族使用的精简 PE 类载荷格式导入 IDA，供二进制分析使用。它建立段、设置导入项名称和类型，并处理重定位以支持数据库改基址。作者还记录了分析 IDA 的 pe.dll 加载器以实现这些功能的过程。",
  "entry_url": "https://awesomerea.org/resources/hidden-bee-ida-loader/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/hidden-bee-ida-loader/",
  "evidence_url": "https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family",
  "group": "tools",
  "id": "hidden-bee-ida-loader",
  "json_url": "https://awesomerea.org/resources/hidden-bee-ida-loader/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/hidden-bee-ida-loader/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/hidden-bee-ida-loader/index.md",
  "name": "Hidden Bee IDA loader",
  "name_zh": "Hidden Bee IDA 文件加载模块",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "scope",
    "license"
  ],
  "requirements": [
    "IDA with IDAPython and the pefile Python module is required.",
    "The loader targets the Hidden Bee custom payload format.",
    "No licence stated on the project page."
  ],
  "requirements_zh": [
    "需要带有 IDAPython 的 IDA，以及 Python pefile 模块。",
    "加载模块面向 Hidden Bee 的自定义载荷格式。",
    "项目页面未说明许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://www.msreverseengineering.com/blog/2018/9/2/weekend-project-a-custom-ida-loader-module-for-the-hidden-bee-malware-family",
  "verification": "source-reviewed",
  "verified_at": "2026-11-09"
}