MalDet · Static Security Report
The repository shows two very different kinds of problems. The most serious issue is that the code contains malware signatures, including ransomware and trojans, which means the software could be used to steal data or damage systems if someone runs it. These malicious patterns are flagged by security tools with a critical score of 346.0, indicating a high likelihood that the code was intentionally created for harm rather than being a mistake. On the other hand, the developer's own codebase has only a low vulnerability risk score of 3.0, meaning it does not contain obvious insecure coding practices that an attacker could exploit from outside. This suggests that while the external code is dangerous, the internal logic used to generate or analyze it appears safe and follows standard security guidelines. In practice, you should treat this repository as unsafe for any production use because of the clear evidence of malicious intent in its source files.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| clamav | Known malware signatures | 33 | 0 | 0 | 33 |
| yara | Signatures of malicious behaviour in source files | 10 | 0 | 0 | 10 |
| semgrep | Insecure coding patterns across many languages | 0 | 1 | 0 | 1 |
34 of 44 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | clamav | ClamAV detected: Win.Trojan.MSShellcode-6360728-0 | 24 | /labs/5-1.Automation/BlueJupyter/FORTRIAGE_extracted/out25.exe |
| high | clamav | ClamAV detected: Win.Trojan.MSShellcode-7 | 4 | /labs/1-1.BasicStaticAnalysis/Malware.PackedAndNotPacked.exe.malz/Malware.PackedAndNotPacked.exe_extracted/Malware.PackedAndNotPacked.exe/Malware.NotPacked.exe.malz |
| high | clamav | ClamAV detected: Doc.Downloader.Pwshell-10001336-0 | 1 | /labs/3-1.GonePhishing-MaldocAnalysis/Word/docm/bookReport_extracted/bookReport.docm |
| high | clamav | ClamAV detected: Eicar-Signature | 1 | /labs/5-1.Automation/BlueJupyter/FORTRIAGE_extracted/out19.exe |
| high | clamav | ClamAV detected: Win.Ransomware.Wanna-9769986-0 | 1 | /labs/4-1.Bossfight-wannacry.exe/Ransomware.wannacry.exe.malz_extracted/Ransomware.wannacry.exe.malz |
| high | clamav | ClamAV detected: Win.Trojan.MSShellcode-6360730-0 | 1 | /labs/5-1.Automation/BlueJupyter/FORTRIAGE_extracted/out14.exe |
| high | clamav | ClamAV detected: Win.Trojan.Swrort-5710536-0 | 1 | /labs/1-1.BasicStaticAnalysis/Malware.PackedAndNotPacked.exe.malz/Malware.PackedAndNotPacked.exe_extracted/Malware.PackedAndNotPacked.exe/Malware.Packed.exe.malz |
| high | yara | YARA rule matched: detect_process_injection — Windows process-injection API sequence | 2 | /labs/2-1.AdvancedStaticAnalysis/Malware.stage0.exe.malz/Malware.stage0.exe.malz_extracted/Malware.stage0.exe.malz |
| high | yara | YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code | 8 | /labs/2-1.AdvancedStaticAnalysis/Dropper.DownloadFromURL.exe.malz/Dropper.DownloadFromURL.exe_extracted/Dropper.DownloadFromURL.exe.malz |
| medium | semgrep | Resources in the AWS subnet are assigned a public IP address. Resources should not be exposed on the public internet, but should have access limited to consumers required for the function of your application. Set `map_public_ip_on_launch` to false so that resources are not publicly-accessible. | 1 | /aws-lab/network.tf:21 |