It is a malware analyzer written in Python2.x for detection of malicious files.
- Detect presence of IP addresses and check if IP is blacklisted using virustotal, ipvoid ( IP reputation checks)
- Detect presence of Domains and check if they are blacklisted in databases like virustotal, urlvoid. (Domain reputation checks)
- Searches for possible e-mail addresses (E-mail reputation checks using SpamAssassin)
- Get results from Virustotal database (Virustotal integration using Virustotal Public API)
- Checks if the file is packed using software packer programs
- Yara rule based checks for viruses, exploits, web shells, anti-debug functionalities etc.
- Analyze PE file header and sections(number of sections, entropy of sections, suspicious section names, suspicious flags in characterstics of PE file etc)
- Detection of anti-virtualization techniques
- Detection of Windows API calls commonly used by malware
- JSON based report
- Checks for viruses,spyware using clamd and pyclamd
- PEStudio integration and extraction of malicious indicators from PEStudio report
- Checks for compiler flags in EXE/DLL. Most reputed programs usually make use of these flags.
- Dynamic base(ASLR)
- NX Compatible(DEP)
- Guard(CFG)
- (Look them in optional header values section)
- Clamd integration
- Virustotal integration - file report(hash report), ip report, url report, domain report
- Analyze ELF file for linux malware analysis using tools such as ldd,readlef, string etc
- Find strings in PE file using sysinternal 'strings' utility(https://docs.microsoft.com/en-us/sysinternals/downloads/strings)
- Check if IP address or domain is listed in DNSBL servers like spamhaus etc.
- PE studio professional for initial malware assessment - purchase license - https://www.winitor.com/tools/pestudio/current/pestudio.zip
- CISCO threat intelligence search - https://talosintelligence.com/reputation_center/lookup?search=igcar.gov.in
- https://github.com/secrary/SSMA
- https://github.com/ClickSecurity/data_hacking/blob/master/pefile_classification/pe_features.py#L317
- https://github.com/hiddenillusion/AnalyzePE/blob/master/AnalyzePE.py
- https://github.com/Ice3man543/MalScan/blob/master/malscan.py
- https://gist.github.com/AfroThundr3007730/91a3e2cbfc848088b70d731133ff3f2a
- https://linux-audit.com/install-clamav-on-centos-7-using-freshclam/
- https://geekdecoder.com/clamav-on-centos-6/
- https://www.decalage.info/python/pyclamd
- https://www.moshe-schmidt.de/linux/clamav-permission-denied-how-to-fix-it/
- https://frankfu.click/web-develop/python/autoadmin-chapter4-python-and-security.html