MalDet report — kh4sh3i/Ransomware-Samples

Summary

This repository has been flagged as extremely dangerous because it contains files that have been identified by security tools as ransomware agents, exploit kits, and malware designed to steal data or encrypt files. The scan found over 49 specific instances of these malicious patterns, with the highest priority alerts coming from ClamAV which detected numerous different types of ransomware like Cerber, Locky, and various droppers. While the vulnerability risk score is low because there are no obvious coding errors that an attacker could easily exploit, the malicious-pattern risk score is critically high, indicating that the code itself likely contains intentional malware rather than just bad security practices. Because these files have been confirmed to be active ransomware agents with 98% confidence, using this repository would expose your system to severe data theft or encryption attacks immediately upon execution.

Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.

Detector	Looks for	High	Medium	Low	Total
clamav	Known malware signatures	32	0	0	32
yara	Signatures of malicious behaviour in source files	17	0	0	17

Evidence

Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.

Severity	Detector	Finding	Seen	Example location
high	clamav	ClamAV detected: Win.Ransomware.Thanos-9755595-0	4	/Thanos/Ransomware.Thanos_extracted/c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
high	clamav	ClamAV detected: Win.Ransomware.Cryakl-9816021-0	3	/Vipasana/Ransomware.Vipasana_extracted/c0cf40b8830d666a24bdd4febdc162e95aa30ed968fa3675e26ad97b2e88e03a
high	clamav	ClamAV detected: Win.Downloader.MSWord-6331390-3	2	/Petrwrap/Ransomware.Petrwrap_extracted/myguy.hta
high	clamav	ClamAV detected: Win.Exploit.CVE_2017_0147-6331310-0	2	/Petrwrap/Ransomware.Petrwrap_extracted/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.bin.gz
high	clamav	ClamAV detected: Rtf.Exploit.CVE_2017_0199-6331394-6	1	/Petrwrap/Ransomware.Petrwrap_extracted/fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.bin.gz
high	clamav	ClamAV detected: Win.Trojan.TeslaCrypt-3	1	/TeslaCrypt/Ransomware.TeslaCrypt_extracted/3372c1edab46837f1e973164fa2d726c5c5e17bcb888828ccd7c4dfcc234a370
high	clamav	ClamAV detected: Win.Trojan.Satana-3	1	/Satana/Ransomware.Satana_extracted/683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.bin
high	clamav	ClamAV detected: Win.Trojan.Petya-6312160-0	1	/Petya/Ransomware.Petya_extracted/4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.bin
high	clamav	ClamAV detected: Win.Trojan.Petya-5637914-0	1	/Petya/Ransomware.Petya_extracted/26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.bin
high	clamav	ClamAV detected: Win.Trojan.CryptoWall-1	1	/Cryptowall/Ransomware.Cryptowall_extracted/cryptowall.bin
high	clamav	ClamAV detected: Win.Ransomware.Wannacryptor-9940180-0	1	/WannaCry/Ransomware.WannaCry_extracted/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
high	clamav	ClamAV detected: Win.Ransomware.Wanna-9769986-0	1	/WannaCry_Plus/Ransomware.WannaCry_Plus_extracted/Win32.Wannacry.exe
high	clamav	ClamAV detected: Win.Ransomware.Trustezeb-9966715-0	1	/Matsnu/Ransomware.Matsnu_extracted/Matsnu-MBRwipingRansomware_1B2D2A4B97C7C2727D571BBF9376F54F_Inkasso Rechnung vom 27.05.2013 .com_
high	clamav	ClamAV detected: Win.Ransomware.TeslaCrypt-9849895-0	1	/TeslaCrypt/Ransomware.TeslaCrypt_extracted/E906FA3D51E86A61741B3499145A114E9BFB7C56
high	clamav	ClamAV detected: Win.Ransomware.TeslaCrypt-7090181-1	1	/TeslaCrypt/Ransomware.TeslaCrypt_extracted/51B4EF5DC9D26B7A26E214CEE90598631E2EAA67
high	clamav	ClamAV detected: Win.Ransomware.Radam-10038734-0	1	/Radamant/Ransomware.Radamant_extracted/DUMP_00A10000-00A1D000.exe.ViR
high	clamav	ClamAV detected: Win.Ransomware.Locky-9659911-0	1	/Locky/Ransomware.Locky_extracted/Locky
high	clamav	ClamAV detected: Win.Ransomware.Karo-6331638-1	1	/Petrwrap/Ransomware.Petrwrap_extracted/svchost.exe
high	clamav	ClamAV detected: Win.Ransomware.HDDCryptor-2	1	/Mamba/Ransomware.Mamba_extracted/131.exe
high	clamav	ClamAV detected: Win.Ransomware.Cerber-6922156-0	1	/Cerber/Ransomware.Cerber_extracted/cerber.exe
high	clamav	ClamAV detected: Win.Malware.Jigsaw-1	1	/Jigsaw/Ransomware.Jigsaw_extracted/jigsaw
high	clamav	ClamAV detected: Win.Dropper.Autit-8177147-0	1	/RedBoot/Ransomware.RedBoot_extracted/1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
high	clamav	ClamAV detected: Win.Coinminer.MSILMiner-6554134-0	1	/Unnamed_0/Ransomware.Unnamed_0_extracted/Ransomware.Unnamed_0.exe
high	clamav	ClamAV detected: Unix.Malware.Agent-1628853	1	/Rex/Ransomware.Rex_extracted/WTEpZSFwgb
high	clamav	ClamAV detected: Doc.Dropper.Agent-7447536-0	1	/Petrwrap/Ransomware.Petrwrap.zip
high	yara	YARA rule matched: detect_process_injection — Windows process-injection API sequence	5	/Thanos/Ransomware.Thanos_extracted/5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
high	yara	YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code	11	/Mamba/Ransomware.Mamba_extracted/131.exe
high	yara	YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together	1	/Rex/Ransomware.Rex_extracted/WTEpZSFwgb

How to read this report

This is a static scan. The code was read, never executed. Behaviour that only appears at runtime is outside what any of these detectors can see.
Findings are not all equally real. A classifier rates each finding on how likely it is to be genuine rather than noise, and that rating weights the scores. Measured against a hand-reviewed sample it reached precision 0.52 and recall 0.62 — useful for ranking, not a verdict on any single finding.
A high score is not proof of malice. Security tools, penetration-testing frameworks and malware research repositories contain the same patterns as real malware by design. The two risk types above exist to keep that distinction visible.
Absence of findings is not proof of safety. A detector that is not installed, or a language none of them parse, produces silence rather than a warning.
This scan is a snapshot. The repository may have changed since 18 September 2026.

Ransomware-Samples

Summary

Risk, by type

What each detector found

Evidence

How to read this report