malware-check

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.

Prerequisites

Ensure malware-check is installed:

pip install malware-check

For full capabilities:

pip install malware-check pefile lief yara-python

Verify with: malware-check info

If not installed, install it before proceeding.

What It Detects

• Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
• Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
• Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
• Crypto miners (stratum pools, mining APIs, wallet addresses)
• Ransomware (file encryption walks, ransom messages)
• Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
• Supply chain attacks (malicious install hooks, dependency confusion)
• Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
• Keyloggers (keyboard hooks across platforms)
• Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
• Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
• Unsafe deserialization, template injection (SSTI)

Usage

Scan source code or project directory

malware-check scan <path> --verbose

Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)

malware-check scan <binary-path> --verbose

Scan with Docker behavioral analysis

# Build sandbox first (one-time)
malware-check build-sandbox

# Run with dynamic analysis
malware-check scan <binary-path> --dynamic --verbose

Scan mobile apps (.apk, .ipa)

malware-check scan app.apk --mobile --verbose

Generate reports

# JSON
malware-check scan <path> --format json -o report.json

# HTML dashboard
malware-check scan <path> --format html -o report.html

# SARIF (for CI/CD)
malware-check scan <path> --format sarif -o report.sarif

Workflow

1. Run malware-check scan <target> --verbose first to get an overview
2. If findings are detected, run malware-check scan <target> --format html -o report.html for a detailed HTML report
3. For binaries, add --dynamic for behavioral analysis in Docker sandbox
4. For mobile apps, add --mobile for MobSF analysis
5. Present findings to the user organized by severity (Critical > High > Medium > Low)
6. For each finding, include: severity, category, file path, line number, evidence, and recommendation
7. Use the SARIF format (--format sarif) when integrating with CI/CD pipelines

Custom YARA Rules

Point to a custom rules directory:

malware-check scan <path> --yara-rules /path/to/rules/

Investigation Tools

When deeper analysis is needed beyond what malware-check provides, refer to docs/INVESTIGATION_TOOLS.md for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).

Key CLI Options

Flag	Purpose
--verbose / -v	Show detailed findings with evidence
--format / -f	Output: console, json, html, sarif
-o / --output	Output file path
--dynamic	Enable Docker sandbox behavioral analysis
--mobile	Enable MobSF mobile analysis
--yara-rules	Custom YARA rules directory
--exit-code	Non-zero exit on findings (for CI)
--no-privacy	Disable privacy analysis