SSMA is a simple malware analyzer written in Python 3. The tool has the following features:
- Analyze PE file’s header and sections (number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc.)
- Searches for possible domains, e-mail addresses, IP addresses in the strings of the file.
- Checks if domains are blacklisted based on abuse.ch’s Ransomware Domain Blocklist and malwaredomains.com’s blocklist.
- Looks for Windows functions commonly used by malware.
- Get results from VirusTotal and/or upload files.
- Malware detection based on Yara-rules
- Detect well-known software packers.
- Detect the existence of cryptographic algorithms.
- Detect anti-debug and anti-virtualization techniques used by malware to evade automated analysis.
- Find if documents have been crafted to leverage malicious code.
Learn more about the tool and it’s usage at project’s GitHub.