MalDet report — InQuest/malware-samples

Summary

This repository shows signs of malicious activity rather than just poor coding practices, as it was flagged for high-risk patterns including process injection and anti-analysis techniques that are rarely found in normal software. While the overall vulnerability risk is low at 18.0, this score only measures common insecure code habits like missing error handling or unsafe loops, which do not necessarily indicate a threat. The most serious issues identified are YARA rules that detected specific malware signatures such as process injection and persistence mechanisms, along with suspicious use of the eval() function which could allow attackers to execute arbitrary code if input is trusted. These findings suggest the code may be part of a known malicious payload rather than safe, legitimate software.

Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.

Risk, by type

MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.

Vulnerability

Low (18)

Insecure coding an attacker could exploit. Usually mistakes, and usually fixable in place.

Malicious pattern

High (62)

Signs the code may be trying to do harm: hidden payloads, credential access, persistence, exfiltration.

What each detector found

Detector	Looks for	High	Medium	Low	Total
yara	Signatures of malicious behaviour in source files	32	0	0	32
semgrep	Insecure coding patterns across many languages	0	12	0	12
bandit	Insecure coding patterns in Python source	0	0	1	1

0 of 45 findings were rated more likely genuine than noise by the classifier.

Evidence

Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.

Severity	Detector	Finding	Seen	Example location
high	yara	YARA rule matched: detect_process_injection — Windows process-injection API sequence	6	/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day/pe-e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.report
high	yara	YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code	23	/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day/pe-e1546323dc746ed2f7a5c973dcecc79b014b68bdd8a6230239283b4f775f4bbd.report
high	yara	YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this	3	/2019-02-Shlayer Malware/a2ec5d9c80794c26a7eaac8586521f7b0eb24aba9ad393c194c86cfd150e5189
medium	semgrep	Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.	12	/2018-04-GandCrab-Swarm/dropper-javascript/0638e4dfe95bdae94a751404e4c91adbb72a57967d4443cde3e4abb16bc293b0.js:1
low	bandit	Try, Except, Continue detected.	1	/2020-07-GlobalSign/extract_ps_from_png.py:19

How to read this report

This is a static scan. The code was read, never executed. Behaviour that only appears at runtime is outside what any of these detectors can see.
Findings are not all equally real. A classifier rates each finding on how likely it is to be genuine rather than noise, and that rating weights the scores. Measured against a hand-reviewed sample it reached precision 0.52 and recall 0.62 — useful for ranking, not a verdict on any single finding.
A high score is not proof of malice. Security tools, penetration-testing frameworks and malware research repositories contain the same patterns as real malware by design. The two risk types above exist to keep that distinction visible.
Absence of findings is not proof of safety. A detector that is not installed, or a language none of them parse, produces silence rather than a warning.
This scan is a snapshot. The repository may have changed since 18 September 2026.