MalFinder

This tool takes a PE file (e.g. *.exe) and checks if the Import Address Table (IAT) contains a suspicious function that is usually used in malware. The process is done by checking if the function name is present at https://malapi.io/ . If so, the tool returns the description of the function and what it is used for.

Installation

git clone https://github.com/oh-az/MalFinder.git
cd MalFinder

Dependencies

dependencies can be installed using the requirements file:

sudo pip3 install -r requirements.txt

Usage

python3 MalFinder.py malware.exe
python3 MalFinder.py mal_library.dll

Added Features

these new features are add by oh-az

• Detect the use of Direct Syscalls by disassembling the binary and looking into it.

• Display information about the binary.
• Calculate each section's entropy to detect potential obfuscation/packing

• Calculate each section's virtual and raw size to detect the potential of packing.

• Extract all IPs from the binary.

  

• Calculate the MD5 hash and sends it to VirusTotal, then it prints out how many vendors have flagged this binary.

Contact

• X: J0e_Binary
• X: ohAz

Version

Current version is 1.2