SSMA - Simple Static Malware Analyzer.

SSMA – Simple Static Malware Analyzer.

SSMA is a simple malware analyzer written in Python 3.

Latest Change 3/7/2017:
+ add new args
+ requirements.txt: ELF support init
+ : check .tls

SSMA – Simple Static Malware Analyzer

– Analyze PE file’s header and sections (number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc.)
– Searches for possible domains, e-mail addresses, IP addresses in the strings of the file.
– Checks if domains are blacklisted based on’s Ransomware Domain Blocklist and’s blocklist.
– Looks for Windows functions commonly used by malware.
– Get results from VirusTotal and/or upload files.
– Malware detection based on Yara-rules
– Detect well-known software packers.
– Detect the existence of cryptographic algorithms.
– Detect anti-debug and anti-virtualization techniques used by malware to evade automated analysis.
– Find if documents have been crafted to leverage malicious code.

Use and install: