Scan report
fabrimagic72 / malware-samples
Could an attacker exploit mistakes in this code?
No issues of this kind were found.
- High
- 0
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Real issues worth reviewing before you rely on this code.
- High
- 11
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 1
- Uncertain
- 1
- Likely noise
- 9
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has been flagged as having a medium risk score of 29.0, which indicates that while the code itself is safe from known vulnerabilities, it contains several suspicious patterns that suggest the project may be intentionally malicious. The most concerning finding is a high-confidence match on VirusTotal for malware samples, meaning many security engines have identified this code as harmful. Additionally, two YARA rules were triggered, one of which detects cryptocurrency mining pools and another checks for common malware evasion techniques like debuggers or sandboxes. These specific patterns are not typical of normal software development and strongly point to the repository being used for malicious purposes rather than legitimate applications.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- VirusTotal · Multi-engine file reputation
- Counts towards
- Malicious pattern
- File
- https://github.com/fabrimagic72/malware-samples
- Likely real
- Yes, 98% confidence
VirusTotal: 2/93 engines flagged as malicious
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Bitcoin miners/02ca4397da55b3175aaa1ad2c99981e792f66151_extracted/02ca4397da55b3175aaa1ad2c99981e792f66151.bin
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Satan/3Rd-LevelHexEatracted_extracted/3Rd-LevelHexEatracted.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/UIWIX/146581f0b3fbe00026ee3ebe68797b0e57f39d1d8aecc99fdc3290e9cfadc4fc_extracted/146581f0b3fbe00026ee3ebe68797b0e57f39d1d8aecc99fdc3290e9cfadc4fc.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Satan/satan_extracted/satan.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /trickbot/trickbot_extracted/Sample_5f6b5cda69480900164d7b49.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Petya/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c (1)
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Grandcrab/grandcab.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Wannacry/mssecsvc_0c694193ceac8bfb016491ffb534eb7c_extracted/mssecsvc.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Wannacry/32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf_extracted/32f24601153be0885f11d62e0a8a2f0280a2034fc981d8184180c5d3b1b9e8cf.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Ransomware/Wannacry/mssecsvc_41b5ba4bf74e65845fa8c9861ca34508_extracted/mssecsvc.bin
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
No findings match these filters.