malware-check
Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.
Prerequisites
Ensure malware-check is installed:
pip install malware-check
For full capabilities:
pip install malware-check pefile lief yara-python
Verify with: malware-check info
If not installed, install it before proceeding.
What It Detects
- Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
- Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
- Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
- Crypto miners (stratum pools, mining APIs, wallet addresses)
- Ransomware (file encryption walks, ransom messages)
- Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
- Supply chain attacks (malicious install hooks, dependency confusion)
- Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
- Keyloggers (keyboard hooks across platforms)
- Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
- Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
- Unsafe deserialization, template injection (SSTI)
Usage
Scan source code or project directory
malware-check scan <path> --verbose
Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)
malware-check scan <binary-path> --verbose
Scan with Docker behavioral analysis
# Build sandbox first (one-time)
malware-check build-sandbox
# Run with dynamic analysis
malware-check scan <binary-path> --dynamic --verbose
Scan mobile apps (.apk, .ipa)
malware-check scan app.apk --mobile --verbose
Generate reports
# JSON
malware-check scan <path> --format json -o report.json
# HTML dashboard
malware-check scan <path> --format html -o report.html
# SARIF (for CI/CD)
malware-check scan <path> --format sarif -o report.sarif
Workflow
- Run
malware-check scan <target> --verbose first to get an overview
- If findings are detected, run
malware-check scan <target> --format html -o report.html for a detailed HTML report
- For binaries, add
--dynamic for behavioral analysis in Docker sandbox
- For mobile apps, add
--mobile for MobSF analysis
- Present findings to the user organized by severity (Critical > High > Medium > Low)
- For each finding, include: severity, category, file path, line number, evidence, and recommendation
- Use the SARIF format (
--format sarif) when integrating with CI/CD pipelines
Custom YARA Rules
Point to a custom rules directory:
malware-check scan <path> --yara-rules /path/to/rules/
Investigation Tools
When deeper analysis is needed beyond what malware-check provides, refer to docs/INVESTIGATION_TOOLS.md for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).
Key CLI Options
| Flag |
Purpose |
--verbose / -v |
Show detailed findings with evidence |
--format / -f |
Output: console, json, html, sarif |
-o / --output |
Output file path |
--dynamic |
Enable Docker sandbox behavioral analysis |
--mobile |
Enable MobSF mobile analysis |
--yara-rules |
Custom YARA rules directory |
--exit-code |
Non-zero exit on findings (for CI) |
--no-privacy |
Disable privacy analysis |
1---2name: malware-check3description: Analyze code, binaries (.exe, .app, .dll, .apk, .ipa), and projects for malicious patterns, backdoors, reverse shells, crypto miners, ransomware, supply chain attacks, and privacy violations. Use this skill whenever the user asks to check if code is malicious, scan a binary for malware, verify an app is safe, audit code security, detect obfuscated payloads, analyze a suspicious file, or review a project for backdoors. Also use when the user mentions "is this safe", "check for malware", "scan this binary", "is this app malicious", "security scan", or "malware analysis".4---5
6# malware-check
7
8Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.
9
10## Prerequisites
11
12Ensure `malware-check` is installed:
13
14```bash
15pip install malware-check
16```
17
18For full capabilities:
19```bash
20pip install malware-check pefile lief yara-python
21```
22
23Verify with: `malware-check info`
24
25If not installed, install it before proceeding.
26
27## What It Detects
28
29- Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
30- Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
31- Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
32- Crypto miners (stratum pools, mining APIs, wallet addresses)
33- Ransomware (file encryption walks, ransom messages)
34- Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
35- Supply chain attacks (malicious install hooks, dependency confusion)
36- Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
37- Keyloggers (keyboard hooks across platforms)
38- Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
39- Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
40- Unsafe deserialization, template injection (SSTI)
41
42## Usage
43
44### Scan source code or project directory
45
46```bash
47malware-check scan <path> --verbose
48```
49
50### Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)
51
52```bash
53malware-check scan <binary-path> --verbose
54```
55
56### Scan with Docker behavioral analysis
57
58```bash
59# Build sandbox first (one-time)
60malware-check build-sandbox
61
62# Run with dynamic analysis
63malware-check scan <binary-path> --dynamic --verbose
64```
65
66### Scan mobile apps (.apk, .ipa)
67
68```bash
69malware-check scan app.apk --mobile --verbose
70```
71
72### Generate reports
73
74```bash
75# JSON
76malware-check scan <path> --format json -o report.json
77
78# HTML dashboard
79malware-check scan <path> --format html -o report.html
80
81# SARIF (for CI/CD)
82malware-check scan <path> --format sarif -o report.sarif
83```
84
85## Workflow
86
871. Run `malware-check scan <target> --verbose` first to get an overview
882. If findings are detected, run `malware-check scan <target> --format html -o report.html` for a detailed HTML report
893. For binaries, add `--dynamic` for behavioral analysis in Docker sandbox
904. For mobile apps, add `--mobile` for MobSF analysis
915. Present findings to the user organized by severity (Critical > High > Medium > Low)
926. For each finding, include: severity, category, file path, line number, evidence, and recommendation
937. Use the SARIF format (`--format sarif`) when integrating with CI/CD pipelines
94
95## Custom YARA Rules
96
97Point to a custom rules directory:
98
99```bash
100malware-check scan <path> --yara-rules /path/to/rules/
101```
102
103## Investigation Tools
104
105When deeper analysis is needed beyond what malware-check provides, refer to `docs/INVESTIGATION_TOOLS.md` for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).
106
107## Key CLI Options
108
109| Flag | Purpose |
110|---|---|
111| `--verbose` / `-v` | Show detailed findings with evidence |
112| `--format` / `-f` | Output: console, json, html, sarif |
113| `-o` / `--output` | Output file path |
114| `--dynamic` | Enable Docker sandbox behavioral analysis |
115| `--mobile` | Enable MobSF mobile analysis |
116| `--yara-rules` | Custom YARA rules directory |
117| `--exit-code` | Non-zero exit on findings (for CI) |
118| `--no-privacy` | Disable privacy analysis |
majiayu000