# Malware Check

> Analyze code, binaries (.exe, .app, .dll, .apk, .ipa), and projects for malicious patterns, backdoors, reverse shells, crypto miners, ransomware, supply chain attacks, and privacy violations. Use this skill whenever the user asks to check if code is malicious, scan a binary for malware, verify an app is safe, audit code security, detect obfuscated payloads, analyze a suspicious file, or review a project for backdoors. Also use when the user mentions "is this safe", "check for malware", "scan this binary", "is this app malicious", "security scan", or "malware analysis".

- Skill: `majiayu000/malware-check` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/malware-check`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/malware-check/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/malware-check

---


# malware-check

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.

## Prerequisites

Ensure `malware-check` is installed:

```bash
pip install malware-check
```

For full capabilities:
```bash
pip install malware-check pefile lief yara-python
```

Verify with: `malware-check info`

If not installed, install it before proceeding.

## What It Detects

- Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
- Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
- Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
- Crypto miners (stratum pools, mining APIs, wallet addresses)
- Ransomware (file encryption walks, ransom messages)
- Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
- Supply chain attacks (malicious install hooks, dependency confusion)
- Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
- Keyloggers (keyboard hooks across platforms)
- Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
- Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
- Unsafe deserialization, template injection (SSTI)

## Usage

### Scan source code or project directory

```bash
malware-check scan <path> --verbose
```

### Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)

```bash
malware-check scan <binary-path> --verbose
```

### Scan with Docker behavioral analysis

```bash
# Build sandbox first (one-time)
malware-check build-sandbox

# Run with dynamic analysis
malware-check scan <binary-path> --dynamic --verbose
```

### Scan mobile apps (.apk, .ipa)

```bash
malware-check scan app.apk --mobile --verbose
```

### Generate reports

```bash
# JSON
malware-check scan <path> --format json -o report.json

# HTML dashboard
malware-check scan <path> --format html -o report.html

# SARIF (for CI/CD)
malware-check scan <path> --format sarif -o report.sarif
```

## Workflow

1. Run `malware-check scan <target> --verbose` first to get an overview
2. If findings are detected, run `malware-check scan <target> --format html -o report.html` for a detailed HTML report
3. For binaries, add `--dynamic` for behavioral analysis in Docker sandbox
4. For mobile apps, add `--mobile` for MobSF analysis
5. Present findings to the user organized by severity (Critical > High > Medium > Low)
6. For each finding, include: severity, category, file path, line number, evidence, and recommendation
7. Use the SARIF format (`--format sarif`) when integrating with CI/CD pipelines

## Custom YARA Rules

Point to a custom rules directory:

```bash
malware-check scan <path> --yara-rules /path/to/rules/
```

## Investigation Tools

When deeper analysis is needed beyond what malware-check provides, refer to `docs/INVESTIGATION_TOOLS.md` for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).

## Key CLI Options

| Flag | Purpose |
|---|---|
| `--verbose` / `-v` | Show detailed findings with evidence |
| `--format` / `-f` | Output: console, json, html, sarif |
| `-o` / `--output` | Output file path |
| `--dynamic` | Enable Docker sandbox behavioral analysis |
| `--mobile` | Enable MobSF mobile analysis |
| `--yara-rules` | Custom YARA rules directory |
| `--exit-code` | Non-zero exit on findings (for CI) |
| `--no-privacy` | Disable privacy analysis |