Malware Analysis Platform (Static)

A static-only malware analysis platform for education and defensive lab work: magic-byte file-type detection, hashing, entropy/packing analysis, string extraction with obfuscation flags, PE import parsing from raw bytes, a mini-YARA signature engine, a SQLite case database, a stdlib HTTP dashboard, and a CLI. Pure Python standard library — no external dependencies, works fully offline.

Features

• File-type detection — magic-byte signatures (PE, ELF, Mach-O, archives, images, documents, SQLite, text).
• Hashing — MD5, SHA-1, SHA-256, SHA-512, SHA3-256 of samples.
• Entropy / packing analysis — Shannon entropy, high-entropy block ratios, known packer section names (.upx, .pack, ...).
• String extraction — ASCII and UTF-16LE strings with obfuscation flags (base64, hex, high-entropy).
• PE import parsing — byte-level parsing of DOS/NT headers, section table, import directory, imported DLLs and functions (32/64-bit).
• Mini-YARA engine — subset of the YARA language: any/all/N of them, $string refs, count(), uint8/16/32(), filesize, and/or/not, plus ascii/wide/nocase/fullword modifiers and hex strings with wildcards.
• SQLite case database — samples, findings, IOCs, hash search.
• Web dashboard — stdlib http.server based sample index and detail views.
• CLI — analyze, submit, cases, serve, rules.

Installation

pip install -e .

Python 3.10+ required. No third-party dependencies.

Usage

# Analyze a file (text report)
malware-analyze analyze sample.bin

# Analyze with JSON output and store the case
malware-analyze analyze sample.bin --json --case-db cases.db

# Submit a sample to the case database
malware-analyze submit sample.bin --case-db cases.db

# List cases
malware-analyze cases --case-db cases.db

# Start the web dashboard
malware-analyze serve --case-db cases.db --port 8080

# List built-in YARA rules
malware-analyze rules

Testing

just test        # or: python -m pytest

All tests run offline using synthetic buffers and generated PE fixtures.

Project Layout

src/malware_analysis_platform/
  filetype.py   magic-byte detection
  hashing.py    multi-algorithm hashing
  entropy.py    entropy + packing heuristics
  strings.py    string extraction + obfuscation flags
  pe.py         byte-level PE parsing (headers, sections, imports)
  yara_engine.py  mini-YARA rule engine
  rules.py      built-in YARA rules
  cases.py      SQLite case database
  webui.py      stdlib HTTP dashboard
  cli.py        malware-analyze command line
tests/          pytest suite

Educational Disclaimer

This project is static analysis tooling for defensive, educational use. It does not execute samples, hook APIs, or interact with live malware. YARA rules are simplistic educational signatures, not production detection coverage. Only analyze files you own or are authorized to test. Always execute potentially malicious files in isolated sandboxes with proper authorization.