Horus v2.0.0

What's new in v2

UEBA behavioral profiling
Maps the PE's capability/import/string profile against 13 software archetypes (Installer, AutomationTool, RAT, Keylogger, Ransomware, Spyware, CryptoMiner, Dropper, Downloader, Loader, SecurityTool, and more). Each archetype applies a risk modifier to the static score so a legitimate packed installer doesn't score the same as a packed RAT.

Use --profile to see the full signal breakdown.

False-positive fix: UPX scoring overhaul
v1 double-penalized UPX sections — each got +18 (RWX) + +16 (packer name) = 34 pts per section. Two UPX sections alone hit 68 pts before any import was checked, pushing legitimate installers like AutoHotkey to 100/100 MALICIOUS.

v2 fixes:

• Known packer section + RWX → single penalty only (no stacking)
• UPX (open-source, widely used by clean software) → 8 pts per section vs 34 before
• VirtualProtect backed out when UPX is present without process injection (it's the unpack stub, not malware)
• ScreenCapture weight 12 → 6; new ScreenCapture + Networking combo adds +10

Result: AutoHotkey 2.x installer 100/100 LIKELY MALICIOUS → 26/100 LOW RISK

Other additions

• Software hint detection from embedded strings (automation tool / installer / security tool)
• Authenticode directory presence reported in PE header
• --profile flag for verbose UEBA signal output
• --json output includes ueba_archetype, ueba_modifier, base_score, has_upx, has_authenticode

Download

File	Platform
horus.exe	Windows x64 — drop it anywhere, no install needed

Quick start

horus suspicious.exe
horus suspicious.exe --profile
horus malware.exe --vt-key YOUR_KEY --json
horus 185.220.101.5 --abuse-key YOUR_KEY
horus 44d88612fea8a8f36de82e1278abb02f