Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations
Install - Usage - Dynamic Analysis - YARA Rules - CI/CD
Docs: English | Tiếng Việt
Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations. Analyzes source code, compiled executables (.exe, .dll, .elf), macOS bundles (.app, .dmg, .pkg), mobile apps (.apk, .ipa), and application packages with YARA rules, Docker behavioral sandboxing, MobSF mobile analysis, payload deobfuscation, and multi-format reporting (JSON, HTML, SARIF).
| Category | Detection Examples |
|---|---|
| Reverse Shells | Python socket+subprocess, bash /dev/tcp, netcat, PowerShell TCPClient, socat |
| Backdoors | Web shells (PHP/JSP/ASP.NET), command injection (Python/JS/Java/Ruby/Go/C), bind shells, hidden routes, remote code loading, user creation, SSTI, unsafe deserialization |
| Obfuscation | Base64+eval chains, char code construction, hex payloads, dynamic imports |
| Crypto Miners | Stratum pool connections, mining APIs, wallet addresses (BTC/ETH/XMR) |
| Ransomware | File encryption walks, ransom messages, encrypt+rename patterns |
| Credential Theft | Hardcoded secrets, clipboard theft, environment harvesting, browser credential files |
| Supply Chain | Suspicious npm/pip install hooks, dependency confusion, custom registries |
| Persistence | Cron/schtasks creation, registry Run keys, LaunchAgent/Daemon, SUID manipulation |
| Privilege Escalation | SUID bit manipulation, setuid(0), chown root |
| Anti-Analysis | Debugger detection, VM detection, TLS callbacks, ptrace usage |
| Keyloggers | GetAsyncKeyState, SetWindowsHookEx, pynput, CGEventTapCreate |
| Privacy | Tracking SDKs (40+), PII fields (SSN, credit cards, biometrics, health), invasive permissions, device fingerprinting |
| Binary Indicators | Packed binaries (UPX, high entropy), RWX sections, suspicious imports, unsigned/tampered code |
pip install malware-check
pipx install malware-check
git clone https://github.com/momenbasel/malware-check.git
cd malware-check
pip install -e ".[dev]"
This installs the core CLI. Binary analysis via pefile/lief, AI-powered file
detection via magika, and YARA scanning via yara-python are optional extras.
# Core + binary analysis + AI file detection + YARA
pip install malware-check[full]
# Or install only what you need
pip install malware-check[binary]
pip install malware-check[detect]
pip install malware-check[yara]
# Or install extras manually
pip install pefile lief magika yara-python
pip install malware-check[detect]
When installed, malware-check uses Magika to improve
cross-platform file identification, enrich file_type metadata, and route extensionless or
disguised files to the correct analyzer based on content instead of filename alone.
# Requires Docker - https://docs.docker.com/get-docker/
# Build the sandbox image (one-time setup)
malware-check build-sandbox
malware-check info
The info command will show whether Magika-powered file detection is available.
Install as a Claude Code skill so Claude can analyze files for you:
# Install the skill from GitHub
npx skills install momenbasel/malware-check --skill malware-check
# Or manually: copy skill/SKILL.md to your skills directory
cp -r skill/ ~/.claude/skills/malware-check/
Then in Claude Code, say: "scan this file for malware" or "is this binary safe?" and Claude will use malware-check automatically.
You also need the CLI tool installed:
pip install malware-check pefile lief yara-python
Install the tool and add to your Codex agent instructions:
# 1. Install the CLI
pip install malware-check pefile lief yara-python
# 2. Add to your Codex instructions (codex.md or system prompt)
echo 'Use `malware-check scan <path> --verbose` to analyze files for malware.' >> AGENTS.md
# 3. Or install as a Codex skill
cp -r skill/ .codex/skills/malware-check/
For any AI coding agent that supports tool use or custom instructions:
# 1. Install
pip install malware-check
# 2. Add to agent instructions:
# "When asked to check code/binaries for malware, use: malware-check scan <target> --verbose"
# "For reports: malware-check scan <target> --format html -o report.html"
# "For CI/CD: malware-check scan <target> --format sarif -o report.sarif --exit-code"
malware-check scan suspicious_file.py
# Best results when malware-check[detect] is installed
malware-check scan suspicious_payload --verbose