Malware Analyzer

Defensive static malware-analysis and triage CLI. It never executes the target file.

Features

• MD5 / SHA-1 / SHA-256
• file-type detection
• byte entropy
• ASCII / UTF-16 strings
• URL / domain / IPv4 IOC extraction
• suspicious-string heuristics
• PE headers and sections
• section entropy / high-entropy indicators
• imports / exports
• suspicious Windows API detection
• PE overlay detection
• TLS callback detection
• timestamp normalization
• optional YARA rules
• JSON reports
• pytest + GitHub Actions CI

Install

Python 3.10+:

python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt

Windows PowerShell:

py -m venv .venv
.\\.venv\\Scripts\\Activate.ps1
python -m pip install -r requirements.txt

Usage

python malanalyze.py suspicious.exe
python malanalyze.py suspicious.exe --output report.json
python malanalyze.py suspicious.exe --no-strings --output report.json

Interpretation

The risk score is a triage heuristic, not a malware verdict. High entropy can indicate packing/compression, but also occurs in legitimate software. Suspicious APIs can be used by legitimate applications.

The tool performs static analysis only. Do not execute unknown samples on a normal workstation. Use an appropriately isolated analysis lab for dynamic analysis.

Publishing

Do not commit malware samples, credentials, private data, API keys, certificates or other material you do not have the right to redistribute.