Digital Forensics Tool: MalStatWare

Reading Time: 2 Minutes

MalStatWare

MalStatWare is written by OSTEsayed and its a tool that automates malware analysis with Python. It extracts key details like file size, type, hash, path, and digital signature. It analyzes headers, APIs, and strings, giving quick insights for threat detection.

Features

• Extracting static information such as:

– File Creation
– File modification
– File Access
– File Size (Bytes)
– File Extension
– File SHA-1
– File SHA-256
– File MD5
– File Blake2b
– File Entropy
– File is executable or NO.
– PE Header Analysis:

• Searching for the Existing of the file in chosen directory or all the system.

Installation

• Python 3.x

git clone https://github.com/OSTEsayed/OSTE-MalStatWare

Usage

usage: MalStatWare-cli.py [-h] [-f FILE] [-i INFO]

MetaStatWare-cli [Action] [option] [value] /n exampl MetaStatWare-cli -f file.text -i all

• Example : python3 MalStatWare-cli.py -f MalStatWare.png -i all
• Example : python3 MalStatWare-cli.py -f MalStatWare.png -s ~/home/DirectoryToSearchIN -i all
• options:
• -h, –help show this help message and exit
• -f FILE, –file FILE Specify the file path Example : directoy/exampl.txt
• -i INFO, –info INFO Gather file information [ALL,SHA-1,SHA-256,MD5,SIZE,TYPE] Default==ALL
• -s SEARCH, –search SEARCH Search if the file exist in chosen directory Example: /home/directoryToSearchIn/
• -pe, –pefile Perform Basic PE header analysis.

Clone the repo from here: GitHub Link