Malware-Analysis-Tool - Static malware analyzer built in Python — extracts

项目说明

🛡️ Malware Analysis Tool

<di="center">

A powerful Python-based malware analysis toolkit for threat hunting, IOC extraction, and YARA rule generation.
Built for cybersecurity researchers and analysts.

Features • Installation • Usage • Output • De

</div>

---

⚠️ Disclaimer

> This tool is de strictly for educational, research, and defensi purposes only.
> It is intended to be used by cybersecurity professionals, malware researchers, and students in controlled en.
> Do NOT use this tool on any system or file you do not own or ha written permission to analyze.
> The de holds no responsibility for any misuse or damage caused by this tool.

---

📌 O

Malware Analysis Tool is a Python-based static analysis toolkit that helps security researchers analyze suspicious files quickly and efficiently. It features two modes:

🖥️ GUI Mode (malware_analyzer.py) — A clean Tkinter-based desktop interface for manual, one-by-one file analysis

⚡ CLI Mode (automated_malware_analyzer.py) — A powerful command-line tool for automated batch analysis with full report generation

Whether you're analyzing a single file or an entire folder of malware samples, this tool extracts critical threat intelligence in seconds.

---

✨ Features

🔍 Core Analysis

| Feature | GUI Mode | CLI Mode |
|---|:---:|:---:|
| File hash calculation (MD5, SHA1, SHA256) | ✅ | ✅ |
| Entropy analysis & obfuscation detection | ✅ | ✅ |
| IP address extraction | ✅ | ✅ |
| Domain extraction (strict, low false positives) | ✅ | ✅ |
| URL extraction | ✅ | ✅ |
| Suspicious string detection | ❌ | ✅ |
| Windows Registry indicator detection | ✅ | ✅ |
| PE file analysis (imports, sections, timestamps) | ❌ | ✅ |
| YARA rule auto-generation per file | ✅ | ✅ |
| YARA rule scanning against existing rules | ❌ | ✅ |
| Batch file / folder scanning | ❌ | ✅ |
| TXT report export | ❌ | ✅ |
| PDF report export | ❌ | ✅ |

🧠 What It Detects

Packed/Encrypted Malware — via high entropy detection (threshold: 7.5)

C2 Communication Indicators — suspicious IPs and domains embedded in files

Malicious URLs — hardcoded download links or beaconing URLs

Persistence Mechanisms — Windows registry Current\Run keys

Suspicious Commands — cmd.exe, powershell, base64, /bin/bash, wget, curl, netcat

PE Metadata — compile timestamps, DLL imports, section names for Windows executables

---

📁 Project Structure

---

⚙️ Installation

Prerequisites

Kali Linux / Ubuntu (recommended)

Python 3.8 or higher

pip3

Step 1 — Clone the Repository

Step 2 — Create a En

Step 3 — Install Dependencies

Dependencies O

| Package | Purpose |
|---|---|
| yara-python | YARA rule compilation and scanning |
| pefile | PE (Windows executable) file parsing |
| fpdf | PDF report generation |
| psutil | System/process monitoring |
| requests | Network-based lookups (future features) |
| pynput | Input monitoring support |
| tkinter | GUI interface (built-in with Python) |

---

🚀 Usage

🖥️ GUI Mode — Manual Analyzer

How to use:
1. Run the command above
2. The GUI window opens automatically
3. Click "Select Files to Analyze"
4. Choose one or more suspicious files
5. Results appear instantly in the output box

GUI Output Example:

---

⚡ CLI Mode — Automated Batch Analyzer

---

📄 Output Samples

Terminal Output (CLI Mode)

Generated Reports

📄 automated_analysis_report.txt — Full plain text report of all analyzed files

📄 automated_analysis_report.pdf — Formatted PDF report for documentation/sharing

📁 yara_rules/<filename>.yara — Indi YARA rule per analyzed file

---

🧪 YARA Rules

Sample Auto-Generated Rule

Built-in Detection Rule (base64_exec_rule.yar)

---

🔒 Supported File Types

| File Type | Supported |
|---|:---:|
| Windows Executables (.exe, .dll) | ✅ |
| Python Scripts (.py) | ✅ |
| Batch Files (.bat, .cmd) | ✅ |
| Shell Scripts (.sh) | ✅ |
| JSON / XML / Text Files | ✅ |
| Shared Libraries (.so, .dylib) | ✅ |
| Any binary file | ✅ |

---

🛠️ How It Works

---

🤝 Contributing

Contributions are welcome! Here's how:

1. Fork the repository
2. Create a new branch: git checkout -b feature/your-feature-name
3. Make your changes and commit: git commit -m "Add: your feature"
4. Push to your branch: git push origin feature/your-feature-name
5. Open a Pull Request

Please make sure your code follows clean coding standards and includes comments.

---

📜 License

This project is licensed under the MIT License.
See the LICENSE file for full details.

---

👨‍💻 De

<di="center">

Md. Munkasir Haque

Cybersecurity Enthusiast | Malware Researcher | Python De

*"Security is not a product, but a process."*

🔐 Passionate about threat intelligence, malware analysis, and building defensi tools.
Currently learning and growing in the field of cybersecurity on Kali Linux.

---

🤝 Connect with Me

💼 LinkedIn — linkedin.com/in/munkasirhaque0x1

> Let's connect and grow together in the cybersecurity community!

</div>

---

<di="center">

⭐ If you found this tool useful, please give it a star on GitHub! ⭐

Made with ❤️ by Md. Munkasir Haque

</div>

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Static malware analyzer built in Python — extracts IPs, domains, URLs, registry indicators, generates YARA rules, and produces analysis reports. For defensive security use only.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。