HORUS v4.1.0

HORUS v4.1.0 makes repeat case triage easier to review and PE comparisons easier to automate.

Highlights:

• Each case refresh records what changed in the current run: added, modified, restored, missing, removed by --prune, and assessment-changed samples. Review the changes array and summary.changes in case.json, the new changes.csv, or the offline dashboard.
• The feed covers the latest refresh, not a historical audit log. Use --verify to detect edits that preserve both file size and modification time.
• horus --diff a.exe b.exe --json provides a machine-readable PE comparison. Incomplete or non-PE comparisons set analysis_status to unknown and exit 3 instead of implying a complete PE comparison.
• Malformed PE input handling and CLI mode validation are stricter.
• The established direct-file, case, and opt-in enrichment workflows remain available. Samples are never uploaded by HORUS.

The three binaries target Windows 10/11 x64. They are not Authenticode-signed; verify downloads with SHA256SUMS.txt and GitHub artifact attestations.

HORUS v4.0.0

Horus v4.0.0 adds persistent case analysis without changing the direct workflow: dropping a file onto the executable or running horus.exe sample.exe still analyzes it immediately.

Highlights:

• Persistent Case Mode for up to 5,000 samples, with incremental refresh, verify, rebuild, prune, portable state, and offline HTML/CSV/JSON reports.
• Exact duplicate groups for every file and explainable PE similarity clusters based on TLSH, imphash, Rich hash, and section layout.
• Content-based direct analysis for files with any extension, including drag-and-drop and paths with spaces.
• Explicit UNKNOWN and analysis_status output when evidence is unavailable, plus documented exit code 3 for incomplete results.
• Opt-in network enrichment with --enrich; only hashes and extracted indicators are sent, never file contents.
• Offline/cache-only Authenticode trust by default, with online revocation available through --online-trust.
• Hardened report embedding, strict JSON parsing, bounded HTTP responses, atomic state/export writes, and CSV formula protection.

The three binaries target Windows 10/11 x64. They are not Authenticode-signed; verify downloads with SHA256SUMS.txt and GitHub artifact attestations.

Horus v3.0.0

Same engine, three ways to run it — and a GUI that finally does the analysis justice.

Downloads

• horus.exe — unified build: CLI by default, --gui (or a double-click) opens the glass console.
• horus-cli.exe — pure command line, zero third-party dependencies.
• horus-gui.exe — drag a file on it for the glass-console report.

What's new

• Glass console (GUI) — a self-contained glassmorphism report: risk ring, a live threat graph wiring the sample to its capabilities / ATT&CK / embedded IOCs, and an ATT&CK heatmap. Inline HTML/CSS/JS, no CDN, nothing leaves the box. Also horus --html report.html to export one.
• --scan <dir> — folder triage, worst-first, with --csv / --json-out.
• --diff a.exe b.exe — imphash, rich-hash, section-entropy drift, TLSH distance.
• --clip — read the indicator off the clipboard.
• ~/.horus.json — keep keys + a cache_ttl_hours; repeat intel lookups come from a local cache.
• Version resource + manifest on every binary to cut AV false positives (see docs/false-positive-report.md).

The --json contract from v2.1 is unchanged, so existing scripts keep working.

Horus v2.1.0

Horus v2.1.0

What's new in v2.1

Similarity / fuzzy hashing

• TLSH (Trend Micro Locality Sensitive Hash) and ssdeep digests, computed
  straight off the file bytes. Both are byte-for-byte compatible with the
  reference tools — verified against libtlsh and ssdeep on real Windows binaries.
• TLSH turns "score one file" into "recognise the family": identical files score
  0, a few edits stay a couple of units apart, unrelated files sit hundreds apart.
• authentihash (the PE hash the Authenticode signature covers) — lets you
  match signed-malware campaigns even when the payload bytes differ.
• rich hash — MD5 of the decoded MSVC Rich header, a compiler/linker build
  fingerprint useful for clustering and attribution.

Real Authenticode verification (not just presence)

• Runs the signature through WinVerifyTrust for both embedded and
  catalog-signed files, so OS binaries are correctly reported as signed.
• Extracts the signer's common name from the PKCS#7 (e.g. Microsoft Windows).
• A file that carries a certificate but no longer verifies is scored as a
  tamper/forgery signal instead of being trusted.

MITRE ATT&CK mapping

• Each significant capability (and the combos that fire) is tagged with its
  technique ID — Injection→T1055, Input Capture→T1056.001, Networking→T1071,
  Crypto+Net→T1486, Token→T1134, and so on — in both the report and the JSON.

More of the PE parsed

• Rich header decode (toolchain records), CodeView PDB path + GUID/age,
  TLS callbacks, export table, appended overlay (offset/size/entropy),
  and .NET / CLR image detection.

Still zero third-party dependencies — the new verification path links only
wintrust and crypt32, which ship with Windows.

Quick start (v2.1)

horus suspicious.exe                 # hashes + TLSH/ssdeep + signature + ATT&CK
horus suspicious.exe --json          # same, machine-readable

---

Horus v2.0.0

What's new in v2

UEBA behavioral profiling
Maps the PE's capability/import/string profile against 13 software archetypes (Installer, AutomationTool, RAT, Keylogger, Ransomware, Spyware, CryptoMiner, Dropper, Downloader, Loader, SecurityTool, and more). Each archetype applies a risk modifier to the static score so a legitimate packed installer doesn't score the same as a packed RAT.

Use --profile to see the full signal breakdown.

False-positive fix: UPX scoring overhaul
v1 double-penalized UPX sections — each got +18 (RWX) + +16 (packer name) = 34 pts per section. Two UPX sections alone hit 68 pts before any import was checked, pushing legitimate installers like AutoHotkey to 100/100 MALICIOUS.

v2 fixes:

• Known packer section + RWX → single penalty only (no stacking)
• UPX (open-source, widely used by clean software) → 8 pts per section vs 34 before
• VirtualProtect backed out when UPX is present without process injection (it's the unpack stub, not malware)
• ScreenCapture weight 12 → 6; new ScreenCapture + Networking combo adds +10

Result: AutoHotkey 2.x installer 100/100 LIKELY MALICIOUS → 26/100 LOW RISK

Other additions

• Software hint detection from embedded strings (automation tool / installer / security tool)
• Authenticode directory presence reported in PE header
• --profile flag for verbose UEBA signal output
• --json output includes ueba_archetype, ueba_modifier, base_score, has_upx, has_authenticode

Download

File	Platform
horus.exe	Windows x64 — drop it anywhere, no install needed

Quick start

horus suspicious.exe
horus suspicious.exe --profile
horus malware.exe --vt-key YOUR_KEY --json
horus 185.220.101.5 --abuse-key YOUR_KEY
horus 44d88612fea8a8f36de82e1278abb02f

Horus v1.0.0

Horus v1.0.0 — Initial Release

Download

File	Description
horus.exe	Pre-built Windows x64 binary — drop it anywhere and run. No installer, no dependencies.

What's in this release

• PE32 / PE32+ static analysis with per-section Shannon entropy visual bars
• 110-API capability knowledge base with combination scoring
  • Injection primitives + runtime API resolution
  • Crypto + network I/O (ransomware / exfil pattern)
  • Keylogger + network I/O
• Imphash calculation matching the Mandiant/pefile recipe
• Embedded IOC pivot: URLs and IPs extracted from strings and enriched automatically
• VirusTotal v3 integration (files, hashes, IPs, domains, URLs)
• AbuseIPDB v2 integration (IP abuse confidence score)
• Parallel fan-out across all configured intel sources
• JSON output mode with scripting-friendly exit codes (0=clean, 1=suspicious, 2=error)
• Zero external dependencies — BCrypt + WinHTTP ship with Windows

Requirements

• Windows 7 x64 or later
• No runtime install needed

Quick start

horus suspicious.exe
horus 185.220.101.5
horus 44d88612fea8a8f36de82e1278abb02f
horus https://sketchy.example/drop.bin --json