Scan report
samratashok / nishang
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 1
- Medium
- 0
- Low
- 0
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Serious issues. Review the high-severity findings before using it.
- High
- 19
- Medium
- 0
- Low
- 0
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 4
- Uncertain
- 2
- Likely noise
- 14
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
The repository has two distinct security risks: a low vulnerability score of 5.0 indicates that the code contains some insecure patterns, but these are likely just standard mistakes rather than intentional attacks. However, the high malicious-pattern score of 40.0 is concerning because it suggests the code may be intentionally designed to bypass security checks or hide malicious behavior. The most serious findings involve PowerShell scripts that execute dangerous commands like remote shell access and process injection, which are strong indicators of malware rather than routine development errors. While some rules flagged as potentially normal were actually used in legitimate applications, the presence of these specific high-confidence detections means the code should not be trusted without further investigation.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /Client/Out-SCT.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Xml.Malware.Squiblydoo-6728833-0
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /Shells/Invoke-PowerShellTcpOneLine.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Win.Trojan.PowershellReverseShellOneLine-9840826-0
-
- Engine
- ClamAV · Antivirus engine
- Counts towards
- Malicious pattern
- File
- /Execution/Execute-DNSTXT-Code.ps1
- Likely real
- Yes, 98% confidence
ClamAV detected: Win.Exploit.Powershell-1
-
- Engine
- Semgrep · Pattern-based code analysis
- Counts towards
- Vulnerability
- File
- /Prasadhak/Invoke-Prasadhak.ps1 line 16
- Likely real
- Yes, 52% confidence
Generic API Key detected
PS > Invoke-Prasadhak -APIKEY 1fe0ef5feca2f84eb450bc3617f839e317b2a686af4d651a9bada77a522201b0 -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Invoke-MimikatzWDigestDowngrade.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Invoke-Mimikatz.ps1
- Likely real
- Uncertain, 36% confidence
YARA rule matched: detect_process_injection — Windows process-injection API sequence
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Check-VM.ps1
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /powerpreter/Powerpreter.psm1
- Likely real
- Probably noise, 18% confidence
YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Invoke-MimikatzWDigestDowngrade.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Client/Out-Excel.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Client/Out-Word.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /powerpreter/Powerpreter.psm1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Backdoors/Execute-OnTime.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Backdoors/DNS_TXT_Pwnage.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Backdoors/HTTP-Backdoor.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Backdoors/Invoke-ADSBackdoor.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Backdoors/Add-ScrnSaveBackdoor.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Utility/Add-Persistence.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Keylogger.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /Gather/Invoke-SessionGopher.ps1
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
No findings match these filters.