🔍 A comprehensive static malware analysis platform powered by machine learning that provides deep insights into Windows PE files and DLLs with intelligent threat detection and severity scoring.

Malvisor is an advanced static malware analysis platform that combines the power of machine learning with comprehensive file analysis to detect and classify various types of malware. Built with modern web technologies and powered by Google's Gemini AI, it provides security researchers, analysts, and developers with a robust tool for malware detection and analysis.

• 🎯 Targeted File Support: Accepts only PE (Portable Executable) files and DLLs for focused Windows malware analysis
• ⚡ Static Analysis: Performs comprehensive static analysis without executing potentially harmful files
• 🔬 Deep Feature Extraction: Extracts critical static features for ML-based classification

• 🧠 LightGBM Model: Utilizes advanced gradient boosting for accurate malware classification
• 📊 Multi-Class Classification: Detects 10 different malware families and benign files
• 🎯 High Accuracy: Trained on extensive datasets for reliable threat detection

• 📋 Detailed Analysis Reports: In-depth analysis with extracted features and classifications
• ⭐ Severity Scoring: Intelligent severity assessment based on threat level
• 💾 Downloadable Reports: Export analysis results in PDF format for documentation
• 🤖 AI-Powered Insights: Gemini AI integration for interactive report analysis

Malvisor can identify the following malware categories:

Malvisor extracts and analyzes the following critical features:

• num_imports 📥: Number of imported functions and libraries
• section_count 📑: Count of PE file sections
• filesize 📏: File size in bytes

• entropy_mean 📊: Average entropy across file sections
• entropy_max 📈: Maximum entropy value found
• entropy_min 📉: Minimum entropy value found

• string_count 📝: Total number of extracted strings
• suspicious_string_count ⚠️: Count of potentially malicious strings

These features are processed through our trained LightGBM model to provide accurate malware classification and threat assessment.

• React 18+ ⚛️: Modern component-based UI framework
• Vite ⚡: Next-generation frontend build tool for blazing fast development
• TailwindCSS 🎨: Utility-first CSS framework for rapid UI development

• Flask 🐍: Lightweight Python web framework for API development
• LightGBM 🤖: Gradient boosting framework for machine learning inference

• Google Gemini API 💎: Advanced AI for intelligent report analysis and interactive querying

• pefile 📁: Python library for parsing PE (Portable Executable) files

  • Extracts headers, sections, imports, and metadata from Windows executables
  • Essential for structural analysis of PE files and DLLs

• string 🔤: Built-in Python module for string operations and constants

  • Used for extracting and analyzing printable strings from binary files
  • Helps identify suspicious text patterns and embedded URLs

• hashlib 🔐: Cryptographic hash functions library

  • Generates MD5, SHA1, SHA256 hashes for file identification
  • Creates unique fingerprints for malware samples

• capstone 🔧: Disassembly framework for multiple architectures

  • Disassembles x86/x64 machine code for static code analysis
  • Enables detection of malicious code patterns and behaviors

• jspdf 📋: JavaScript library for PDF generation

  • Creates downloadable analysis reports in PDF format
  • Enables professional documentation of analysis results

• react-markdown 📝: React component for rendering Markdown content

  • Displays formatted analysis reports and documentation
  • Provides rich text rendering capabilities for better readability

• Node.js 16+ and npm
• Python 3.8+
• Google Gemini API key

1. Clone the repository

   git clone https://github.com/PrathicaShettyM/Malvisor.git

2. Setup Frontend

   cd client
   npm install
   npm run dev

3. Setup Backend

   cd server
   pip install -r requirements.txt
   python app.py

4. Configure Environment

   # Add your Gemini API key to environment variables
   export GEMINI_API_KEY=your_api_key_here

1. 📤 Upload File: Select and upload a PE file or DLL through the web interface
2. ⏳ Analysis: The system automatically extracts static features and processes them through the ML model
3. 📊 Results: View comprehensive analysis results including malware classification and severity score
4. 🤖 AI Insights: Use the Gemini AI bot to ask questions about the analysis report
5. 💾 Export: Download detailed PDF reports for documentation and further analysis

• 🛡️ Safe Analysis: Static analysis only - no file execution
• 🔍 Comprehensive Detection: Multi-layered feature extraction and analysis
• 📈 Severity Assessment: Intelligent threat level classification
• 🤖 AI-Enhanced: Gemini AI provides additional insights and explanations

We welcome contributions! Please feel free to submit issues, feature requests, or pull requests to help improve Malvisor.

This project is licensed under the MIT License - see the LICENSE file for details.