Malwoverview
Copyright (C) 2018-2026 Alexandre Borges (https://exploitreversing.com)
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
See GNU Public License on <http://www.gnu.org/licenses/>.
Current Version: 8.2.0 (Codename: Revolutions)
Important note: Malwoverview does NOT submit samples to any endpoint by default,
so it respects possible Non-Disclosure Agreements (NDAs). There're specific options
that explicitly submit samples, but these options are explained in the help.
ABOUT
Malwoverview.py is a first response tool for threat hunting, which performs an initial and quick
triage of malware samples, URLs, IP addresses, domains, malware families, IOCs and hashes. Additionally,
Malwoverview is able to get dynamic and static behavior reports, submit and download samples
from several endpoints. In few words, it works as a client to main existing sandboxes.
This tool aims to :
- Determine similar executable malware samples (PE/PE+) according to the import table (imphash) and group
them by different colors (pay attention to the second column from output). Thus, colors matter!
- Show hash information on Virus Total, Hybrid Analysis, Malshare, Polyswarm, URLhaus, Alien Vault,
Malpedia and ThreatCrowd engines.
- Determining whether the malware samples contain overlay and, if you want, extract it.
- Check suspect files on Virus Total, Hybrid Analysis and Polyswarm.
- Check URLs on Virus Total, Malshare, Polyswarm, URLhaus engines and Alien Vault.
- Download malware samples from Hybrid Analysis, Malshare, URLHaus, Polyswarm and Malpedia engines.
- Submit malware samples to VirusTotal, Hybrid Analysis and Polyswarm.
- List last suspected URLs from URLHaus.
- List last payloads from URLHaus.
- Search for specific payloads on the Malshare.
- Search for similar payloads (PE32/PE32+) on Polyswarm engine.
- Classify all files in a directory searching information on Virus Total and Hybrid Analysis.
- Make reports about a suspect domain using different engines such as VirusTotal, Malpedia and
ThreatCrowd.
- Check APK packages directly from Android devices against Hybrid Analysis and Virus Total.
- Submit APK packages directly from Android devices to Hybrid Analysis and Virus Total.
- Show URLs related to an user provided tag from URLHaus.
- Show payloads related to a tag (signature) from URLHaus.
- Show information about an IP address from Virus Total, Alien Vault, Malpedia and ThreatCrowd.
- Show IP address, domain and URL information from Polyswarm.
- Perform meta-search on Polyswarm Network using several criteria: imphash, IPv4, domain, URL and
malware family.
- Gather threat hunting information from AlienVault using different criteria.
- Gather threat hunting information from Malpedia using different criteria.
- Gather threat hunting information from Malware Bazaar using different criteria.
- Gather IOC information from ThreatFox using different criteria.
- Gather threat hunting information from Triage using different criteria.
- Get evaluation to hashes from a given file against Virus Total.
- Submit large files (>= 32 MB) to Virus Total.
- Malwoverview uses Virus Total API v.3, so there isn’t longer any option using v.2.
- Retrieve information about a given IP address from IPInfo service.
- Retrieve combined information about a given IP address from multiple services.
- Offer extra option to save any downloaded file to a central location.
- List and search vulnerabilities from NIST through different criterias.
- Query VulnCheck database - Community/Free tier.
- Gather threat hunting information from Shodan using different criteria.
- Check IP reputation from AbuseIPDB.
- Check IP classification from GreyNoise (community API).
- Perform domain and IP Whois/RDAP lookups.
- Cross-service hash correlation across VirusTotal, Hybrid Analysis, Triage, and AlienVault.
- Batch hash check against Malware Bazaar from a file containing hashes.
- Batch hash check against Hybrid Analysis from a file containing hashes.
- Batch hash check against Triage from a file containing hashes.
- Directory scan against Malware Bazaar, Hybrid Analysis, and Triage.
- Extract IOCs (hashes, IPs, URLs, domains, CVEs) from text files.
- Scan files or directories with YARA rules.
- Interactive REPL mode for continuous threat hunting sessions.
- JSON and CSV structured output formats.
- Result caching with configurable TTL (SQLite-based).
- HTTP/HTTPS/SOCKS5 proxy support for all API requests.
- MITRE ATT&CK technique mapping for behavior reports.
- TUI (Text User Interface) dashboard mode with panel-based navigation.
- Gather threat hunting information from URLScan.io — submit URLs, retrieve scan results, and search scans.
- LLM-powered threat enrichment — AI-generated risk assessment, MITRE ATT&CK mapping, and analyst recommendations appended to any query result. Supports Claude, Gemini, OpenAI, and Ollama (local).
- Batch IP check against VirusTotal from a file containing IP addresses, showing a summary table (IP Address, Country, AS Owner, Detection).
- Hunt on VirusTotal with YARA rules: submit and follow Retrohunt jobs, list the matched files, and create and list Livehunt rulesets and notifications.
- Scan with a whole directory of YARA rules, each file compiled in its own namespace.
- Search Malware Bazaar samples by YARA rule name, and download and extract the YARAify rule set from abuse.ch.
- Download the complete Malpedia YARA ruleset for a given TLP level.
- List the MalShare file types seen in the last 24 hours, and list the hashes of any of those types.
- Batch hash check against URLHaus from a file containing hashes.
- Certificate Transparency pivots through crt.sh, with no API key: enumerate the subdomains seen in issued certificates and list the certificates themselves.
- Inspect, prune and empty the local result cache.
- Interactive mode and TUI reach every service the command line reaches, and the TUI exports its results to json and csv.
- Local PE triage of a file or directory with no API key, listing file type, size, overlay, overlay size and entropy, and highlighting the files above an entropy threshold.
- Android scans hash every APK of a package, including the split APKs, instead of the base APK alone.
- Authenticode signature checking with no API key, reporting whether a binary is signed and whether the signature is still valid, and naming the signer of a tampered file.
- Every embedded signature of a multi-signed binary is reported, each with its own digest algorithm, certificate, thumbprint and serial number, so a second signer is never hidden behind the first.
- The VirusTotal file check (-v 1) and hash report (-v 8) show the signature block: whether the certificate verified, the signer and counter signer chains, the signing date and every certificate with its status, algorithm, validity dates, serial number and thumbprint.
- List the CVEs associated with a component, given either its name or the path to a local binary, whose VERSIONINFO supplies the component description that modern NVD entries are written against.
CONTRIBUTORS
Alexandre Borges (https://github.com/alexandreborges) | project owner and main developer
Artur Marzano (https://github.com/Macmod) | co-main developer
Corey Forman (https://github.com/digitalsleuth) | responsible for REMnux integration
Christian Clauss (https://github.com/cclauss)
HOW TO CONTRIBUTE TO THIS PROJECT
Since version 6.0.0, there is a new branch named “dev”. All contributions and proposals
must be done into this “dev” branch.
Professionals who want to contribute must open an issue explaining your proposed improvement
and how it would make the project better. Once it has been accepted, so she/he is
authorized to submit the PR, which will be tested.
Once all changes are tested, this new version of Malwoverview is replicated to the master
branch and a new Python package is generated.
INSTALLATION
This tool has been tested on REMnux, Ubuntu, Kali Linux, macOS and Windows. Malwoverview
can be installed by executing the following command:
* pip3.11 install git+https://github.com/alexandreborges/malwoverview
or...
* python -m pip install -U malwoverview
If you want to install the Malwoverview on macOS, you have to execute the following commands:
* /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
* brew install libmagic
* pip3 install urllib3==1.26.6
* pip3 install -U malwoverview
* Add Python binary directory to the PATH variable by editing .bash_profile file in your home
directory. Example:
export PATH=$PATH:/Users/alexandreborges/Library/Python/3.9/bin
* Execute: . ./.bash_profile
If you are installing Malwoverview on Windows, make sure that the following conditions are true
AFTER having installed Malwoverview:
* python-magic is NOT installed. (pip show python-magic)
* python-magic-bin IS installed. (pip show python-magic-bin)
Note: It is recommended to save the .malwapi.conf before any update!
Optional Features
Some features require optional dependencies. Install them as needed:
* YARA scanning: pip install malwoverview[yara]
* Signature checking: pip install malwoverview[signature]
* PDF report export: pip install malwoverview[pdf]
* TUI dashboard: pip install malwoverview[tui]
* All optional: pip install malwoverview[all]
REQUIRED APIs
It is possible to start using Malwoverview does without inserting all APIs. However,
to use all options of Malwoverview, you must insert the respective API of the following services:
VirusTotal, Hybrid Analysis, URLHaus, Malshare, Polyswarm, Alien Vault, Malpedia, Triage,
IPInfo, Malware Bazaar, ThreatFox, VulnCheck, Shodan, AbuseIPDB, GreyNoise and URLScan.io into the .malwapi.conf configuration file, which
must be present (or created) in the home directory (/home/[username]
or /root on Linux, and C:\Users[username] on Windows. Alternatively, users can create
a custom configuration file and indicate it by using the -c option.
To highlight: if the .malwapi.conf file does not exist in your home directory, so you must
create it!
-
A special note about the Alien Vault: it is necessary to subscribe to pulses on Alien Vault
website before using -n 1 option.
-
A special note about Malshare and Shodan: both services require their API key to be sent in the
URL itself, and neither documents a header or a request body alternative (the Malshare hashlookup
endpoint is a POST, but the key still travels in the query string). Malwoverview replaces these two
keys with [REDACTED] in every error message it prints, so they do not end up in the output you paste
into a bug report, but the key is still recorded in the access logs of those services and in any
proxy that terminates TLS between you and them. Treat both keys as exposed to the service operator
and rotate them as you would any other credential.
The .malwapi.conf configuration file has the following format:
[VIRUSTOTAL]
VTAPI =
[HYBRID-ANALYSIS]
HAAPI =
[MALSHARE]
MALSHAREAPI =
[HAUSSUBMIT]
HAUSSUBMITAPI =
[POLYSWARM]
POLYAPI =
[ALIENVAULT]
ALIENAPI =
[MALPEDIA]
MALPEDIAAPI =
[TRIAGE]
TRIAGEAPI =
[IPINFO]
IPINFOAPI =
[BAZAAR]
BAZAARAPI =
[THREATFOX]
THREATFOXAPI =
[VULNCHECK]
VULNCHECKAPI =
[URLHAUS]
URLHAUSAPI =
[SHODAN]
SHODANAPI =
[ABUSEIPDB]
ABUSEIPDBAPI =
[GREYNOISE]
GREYNOISEAPI =
[URLSCANIO]
URLSCANIOAPI =
[LLM]
PROVIDER = claude
CLAUDE_API_KEY =
CLAUDE_MODEL = claude-opus-4-8
GEMINI_API_KEY =
OPENAI_API_KEY =
OPENAI_MODEL = gpt-4o-mini
OLLAMA_URL = http://localhost:11434
OLLAMA_MODEL = llama3.1
The APIs can be requested on the respective service websites:
- Virus Total (community and paid API): https://www.virustotal.com/gui/join-us
- Hybrid Analysis: https://www.hybrid-analysis.com/signup
- Malshare: https://malshare.com/doc.php
- URLHaus: https://urlhaus.abuse.ch/api/#account
- Polyswarm: https://docs.polyswarm.io/consumers
- Alien Vault: https://otx.alienvault.com/api
- Malpedia: It doesn’t offer open registration, but you can request an user account
directly through Twitter (DM) or feedback e-email. The Malpedia Twitter
handle is @malpedia.
- Malware Bazaar: https://bazaar.abuse.ch/api/#auth\_key
- ThreatFox: https://threatfox.abuse.ch/api/#auth\_key
- Triage: https://tria.ge/signup.
- IPInfo: https://ipinfo.io/
- VulnCheck: https://vulncheck.com/signin (Community/Free tier available)
- Shodan: https://account.shodan.io/register
- AbuseIPDB: https://www.abuseipdb.com/register
- GreyNoise: https://viz.greynoise.io/signup
- URLScan.io: https://urlscan.io/user/signup
LLM Enrichment Providers (optional)
Malwoverview supports LLM-powered threat enrichment via the --enrich flag.
After any query, an AI-generated threat assessment is appended with risk level,
malware family identification, MITRE ATT&CK mapping, and analyst recommendations.
Three providers are supported. Configure one in the [LLM] section of .malwapi.conf:
18. Anthropic Claude (paid, best quality)
Best results for threat intelligence analysis. Accurately identifies malware
families, maps precise MITRE ATT&CK techniques, and provides actionable
recommendations based on real threat knowledge.
Setup:
a) Create an API account at https://console.anthropic.com/ (separate from
claude.ai subscription)
b) Go to Settings → Billing → Add credit ($5 minimum, pay-per-use)
c) Go to Settings → API Keys → Create Key
d) Copy the key (starts with sk-ant-api03-...)
e) Configure .malwapi.conf:
[LLM]
PROVIDER = claude
CLAUDE_API_KEY = sk-ant-api03-your-key-here
CLAUDE_MODEL = claude-opus-4-8
CLAUDE_MODEL is optional and defaults to claude-opus-4-8. Common choices:
- claude-opus-4-8 — Best quality (default)
- claude-sonnet-4-6 — Strong balance of quality and cost
- claude-haiku-4-5 — Fastest and cheapest
Cost: ~$0.02-0.04 per enrichment call using the default Opus model (less with
Sonnet or Haiku). $5 credit provides roughly 125-250 Opus enrichment calls.
19. Google Gemini (requires billing)
Good quality results. Requires a Google Cloud billing account.
Setup:
a) Go to https://aistudio.google.com/apikeys
b) Sign in with Google account
c) Click Create API Key → copy the key
d) Enable billing: click the project link next to your key → Google Cloud
Console → Billing → Link a billing account
e) Configure .malwapi.conf:
[LLM]
PROVIDER = gemini
GEMINI_API_KEY = your-gemini-key-here
GEMINI_MODEL = gemini-2.0-flash
Note: The free tier has a low rate limit (2-5 requests per minute). For
higher limits, enable pay-per-use billing.
20. OpenAI (paid)
Good quality results using GPT models. Requires an OpenAI account with
API credits.
Setup:
a) Create an account at https://platform.openai.com/signup
b) Go to https://platform.openai.com/api-keys → Create new secret key
c) Add billing at https://platform.openai.com/settings/organization/billing
d) Configure .malwapi.conf:
[LLM]
PROVIDER = openai
OPENAI_API_KEY = sk-your-key-here
OPENAI_MODEL = gpt-4o-mini
Available models:
- gpt-4o-mini — Cheapest (~$0.002 per enrichment), good quality (default)
- gpt-4o — Better quality (~$0.01 per enrichment)
21. Ollama (free, local, private)
Runs entirely on your machine. No API key needed, no data leaves your
system. Good for environments where sending threat data to cloud APIs
is not permitted. Quality depends on the model chosen.
Setup:
a) Download and install Ollama from https://ollama.com/download
(available for Windows, Linux, and macOS)
b) Open a terminal and pull a model:
ollama pull qwen2.5:14b
Recommended models:
- qwen2.5:14b — Best quality at reasonable size (9 GB, needs 16 GB RAM)
- llama3.1:8b — Good quality, smaller (5 GB, needs 8 GB RAM)
- llama3.1:70b — Excellent quality, large (40 GB, needs 48 GB RAM)
c) Ollama starts automatically and serves on http://localhost:11434
d) Configure .malwapi.conf:
[LLM]
PROVIDER = ollama
OLLAMA_URL = http://localhost:11434
OLLAMA_MODEL = qwen2.5:14b
Performance: GPU with 12+ GB VRAM provides fast responses (5-10s).
CPU-only is slower (30-60s) but functional. Larger models (14b, 70b)
require more VRAM and may timeout on CPU if insufficient memory is
available. The llama3.1:8b model is recommended for machines with
limited GPU memory (6 GB or less).
Expected response times:
- Claude API: 3-8 seconds
- Gemini API: 3-8 seconds
- Ollama (GPU with sufficient VRAM): 5-15 seconds
- Ollama (CPU-only, 8b model): 30-60 seconds
- Ollama (CPU-only, 14b+ model): 60-300 seconds
Usage examples:
# CLI: append --enrich to any query
malwoverview -v 8 -V <hash> --enrich
malwoverview -ip 1 -IP 8.8.8.8 --enrich
malwoverview --correlate-hash <hash> --enrich
# Interactive REPL: toggle enrichment on/off or switch provider
malwoverview --interactive
malwoverview> set enrich on # use provider from config
malwoverview> set enrich claude # switch to Claude
malwoverview> set enrich ollama # switch to Ollama
malwoverview> set enrich openai # switch to OpenAI
malwoverview> set enrich off # disable enrichment
malwoverview> vt hash <hash> # malware analysis + enrichment
malwoverview> nist cve CVE-2024-3400 # CVE lookup + enrichment
malwoverview> vulncheck cve CVE-2024-3400 # VulnCheck + enrichment
# TUI: click the Enrich button to cycle through providers
# Enrich (OFF) → claude → gemini → openai → ollama → OFF
# Green button = provider active and configured
# Yellow button = provider selected but API key missing
# Default button = enrichment disabled
malwoverview --tui
Note about API requests to the MALPEDIA:
The service and acceptance are based on the community vetting. Thus, it’s
recommended that you submit an API request from your business e-mail address
and NOT from a public/free one (Gmail, Outlook and so on). Additionally, it
would be great if you provided more information about yourself (LinkedIn
account, X/Twitter, Mastodon, BlueSky, etc.) as this would facilitate
verification of your identity, professional profile, and legitimacy,
speeding up the approval of your request.
Note about Triage:
Every Triage operation is based on the Triage ID of each artifact, so you
need touse the “-x 1 -X <attribute>:<value>” to search for the
correct ID of the artifact then use this ID information with the
remaining Triage options (-x [2-7]) to get more threat hunting information
from Triage endpoint.
Note about URLHaus, Malware Bazaar and Threat Fox:
Starting in the second half of 2025, an Auth-Key (API) will be required to
use the URLHaus,Malware Bazaar and Threat Fox services.
Note about background color of the terminal:
Malwoverview was written to produce output for a dark
terminal background. However, there is the -o 0 option
that changes and adapts the output colors for a light background.
To check the installation, execute:
malwoverview --help
Further information is available on:
(PYPI.org repository) https://pypi.org/project/malwoverview/
(Github) https://github.com/alexandreborges/malwoverview
If you want to perform the manual installation (it is not usually necessary),
so few steps should be executed, as shown in the next sub-section.
MANUAL INSTALLATION (REMnux and Ubuntu)
-
Python version 3.11 or later (Only Python 3.x !!! It does NOT work using
Python 2.7)
$ apt-get install python3.11 (for example)
-
Python-magic.
To install python-magic package you can execute the following command:
$ pip3.11 install python-magic
Or you can compile it from the github repository:
$ git clone https://github.com/ahupp/python-magic
$ cd python-magic/
$ python3.11 setup.py build
$ python3.11 setup.py install
As there are serious issues related to existing two versions of
python-magic package, the recommendation is to install it from
Github (second procedure above) and copy the magic.py file to the
SAME directory of malwoverview tool.
-
Install all needed Python packages:
$ pip3.11 install -r requirements.txt
OR
$ pip3.11 install -U pefile
$ pip3.11 install -U colorama
$ pip3.11 install -U simplejson
$ pip3.11 install -U python-magic
$ pip3.11 install -U requests
$ pip3.11 install -U validators
$ pip3.11 install -U geocoder
$ pip3.11 install -U polyswarm-api
$ pip3.11 install -U pathlib
$ pip3.11 install -U configparser
-
To check an Android mobile you need to install the “adb” tool:
$ sudo apt get install adb
PS: before trying Android’s options, check:
* If the adb tool is listed in the PATH environment variable.
* If the system has authorized access to the device by using "adb devices -l"
HELP
usage: python malwoverview.py -c -d -o <0|1> -v <1-20>
-V -a <1-13> -A -l <1-8> -L <hash|file type> -j <1-8>
-J -p <1-8> -P -y <1-5> -Y -n <1-5>
-N -m <1-9> -M -b <1-15> -B -x <1-9> -X
-ip <1-8> -IP -O
Malwoverview is a first response tool for threat hunting written by Alexandre Borges.
MALWARE OPTIONS:
Malware analysis and intelligence query options
-h, --help
+ show this help message and exit
-c CONFIG FILE, --config CONFIG FILE
+ Use a custom config file to specify API's.
-d DIRECTORY, --directory DIRECTORY
+ Specifies the directory containing malware samples to be checked against VIRUS TOTAL.
+ Use the option -D to decide whether you are being using a public VT API or a Premium
VT API.
-o BACKGROUND, --background BACKGROUND
+ Adapts the output colors to a light background color terminal.
+ The default is dark background color terminal.
-v VIRUSTOTAL, --virustotal_option VIRUSTOTAL
+ -v 1: given a file using -V option, it queries the VIRUS TOTAL database (API v.3)
to get the report for the given file through -V option.
+ v 2: it shows an antivirus report for a given file using -V option (API v.3);
+ v 3: equal to -v2, but the binary's IAT and EAT are also shown (API v.3);
+ v 4: it extracts the overlay;
+ v 5: submits an URL to VT scanning;
+ v 6: submits an IP address to Virus Total;
+ v 7: this options gets a report on the provided domain from Virus Total;
+ v 8: verifies a given hash against Virus Total;
+ v 9: submits a sample to VT (up to 32 MB). Use forward slash to specify the
target file on Windows systems. Demands passing sample file with -V option;
+ -v 10: verifies hashes from a provided file through option -V. This option uses
public VT API v.3;
+ -v 11: verifies hashes from a provided file through option -V. This option uses
Premium API v.3;
+ -v 12: it shows behaviour information of a sample given a hash through option -V.
This option uses VT API v.3; -v 13: it submits LARGE files (above 32 MB)
to VT using API v.3;
+ -v 14: submits a Retrohunt job using the YARA rules file or rules directory
given with -V (VT scans the samples it received over the past months
against the rules);
+ -v 15: lists your Retrohunt jobs, optionally filtered by a status passed
through -V (starting, running, aborting, aborted or finished);
+ -v 16: shows the status and progress of the Retrohunt job whose id is
given with -V;
+ -v 17: lists the files matched by the Retrohunt job whose id is given with -V;
+ -v 18: creates a Livehunt ruleset from the YARA rules file or rules directory
given with -V (VT then matches every new submission against it);
+ -v 19: lists your Livehunt rulesets;
+ -v 20: lists your Livehunt notifications. Options 14 to 20 need a VT key with
premium (enterprise) privileges;
-V VIRUSTOTAL_ARG, --virustotal_arg VIRUSTOTAL_ARG
+ Provides argument for -v option. If "-v 1" to "-v 4" then -V must be
a file path; If "-v 5" then -V must be a URL; If "-v 6" then -V must
be an IP address; If "-v 7" then -V must be a domain; If "-v 8" then
-V must be a hash (MD5/SHA1/SHA256); If "-v 9" or "-v 13" then -V must
be a file path to submit; If "-v 10" or "-v 11" then -V must be a file
containing hashes (one per line); If "-v 12" then -V must be a hash for
behavior analysis; If "-v 14" or "-v 18" then -V must be a YARA rules
file or a directory of rules; If "-v 15" then -V may be a job status;
If "-v 16" or "-v 17" then -V must be a Retrohunt job id.
-a HYBRID_ANALYSIS, --hybrid_option HYBRID_ANALYSIS
+ This parameter fetches reports from HYBRID ANALYSIS, download samples and submits
samples to be analyzed.
+ The possible values are:
+ 1: gets a report for a given hash or sample from a Windows 7 32-bit environment;
+ 2: gets a report for a given hash or sample from a Windows 7 32-bit
environment (HWP Support);
+ 3: gets a report for given hash or sample from a Windows 64-bit environment;
+ 4: gets a report for a given hash or sample from an Android environment;
+ 5: gets a report for a given hash or sample from a Linux 64-bit environment;
+ 6: submits a sample to Windows 7 32-bit environment;
+ 7. submits a sample to Windows 7 32-bit environment with HWP support environment;
+ 8. submits a sample to Windows 7 64-bit environment;
+ 9. submits a sample to an Android environment;
+ 10. submits a sample to a Linux 64-bit environment;
+ 11. downloads the sample for a given hash (the stored sample is the
same regardless of the sandbox environment, so a single option
replaces the former options 11 to 15);
+ 12. batch hash check from a file (one hash per line);
+ 13. directory scan - computes SHA256 for each file and checks
against Hybrid Analysis.
-A SUBMIT_HA, --ha_arg SUBMIT_HA
+ Provides argument for -a option from HYBRID ANALYSIS. If "-a 1" to
"-a 5" then -A must be a hash or a file path (auto-detected); If "-a 6"
to "-a 10" then -A must be a file path to submit; If "-a 11" then -A
must be a hash to download; If "-a 12" then -A must be a file
containing hashes (one per line); If "-a 13" then -A must be a directory
path to scan.
-D VT_PUBLIC_PREMIUM, --vtpubpremium VT_PUBLIC_PREMIUM
+ This option must be used with -d option.
+ Possible values:
+ <0> it uses the Premium VT API v3 (default);
+ <1> it uses the Public VT API v3.
-l MALSHARE_HASHES, --malsharelist MALSHARE_HASHES
+ This option performs download a sample and shows hashes of a specific type
from the last 24 hours from MALSHARE repository.
+ Possible values are:
+ 1: Download a sample;
+ 2: PE32 (default) ;
+ 3: ELF ;
+ 4: Java;
+ 5: PDF ;
+ 6: List the file types available in the last 24 hours (and how many
samples of each);
+ 7: List of hashes from past 24 hours;
+ 8: List hashes of the file type given with -L (use -l 6 to discover
the valid file types).
-L MALSHARE_HASH_SEARCH, --malshare_hash MALSHARE_HASH_SEARCH
+ Provides a hash as argument for downloading a sample from MALSHARE
repository (-l 1) or, when used with -l 8, the file type whose hashes
must be listed.
-j HAUS_OPTION, --haus_option HAUS_OPTION
+ This option fetches information from URLHaus depending of the value passed as argument:
+ 1: performs download of the given sample;
+ 2: queries information about a
provided hash ;
+ 3: searches information about a given URL;
+ 4: searches a malicious URL by a given tag (case sensitive);
+ 5: searches for payloads given a tag;
+ 6: retrives a list of downloadable links to recent payloads;
+ 7: retrives a list of recent malicious URLs;
+ 8: batch hash check from a file (one hash per line).
-J HAUS_ARG, --haus_arg HAUS_ARG
+ Provides argument for -j option from URLHaus. If "-j 1" then -J must
be a SHA256 hash to download the sample; If "-j 2" then -J must be a
hash (MD5/SHA1/SHA256) to search; If "-j 3" then -J must be a URL to
check; If "-j 4" then -J must be a tag (case sensitive); If "-j 5" then
-J must be a signature name.
-p POLY_OPTION, --poly_option POLY_OPTION
+ (Only for Linux) This option is related to POLYSWARM operations:
+ 1. searches information related to a given hash provided using -P option;
+ 2. submits a sample provided by -P option to be analyzed by Polyswarm engine ;
+ 3. Downloads a sample from Polyswarm by providing the hash throught option -P.
Attention: Polyswarm enforces a maximum of 20 samples per month;
+ 4. searches for similar samples given a sample file thought option -P;
+ 5. searches for samples related to a provided IP address through option -P;
+ 6. searches for samples related to a given domain provided by option -P;
+ 7. searches for samples related to a provided URL throught option -P;
+ 8. searches for samples related to a provided malware family given by option -P.
-P POLYSWARM_ARG, --poly_arg POLYSWARM_ARG
+ (Only for Linux) Provides an argument for -p option from POLYSWARM.
-y ANDROID_OPTION, --android_option ANDROID_OPTION
+ This ANDROID option has multiple possible values:
+ <1>: Check all third-party APK packages from the USB-connected Android device
against Hybrid Analysis using multithreads. Notes: the Android device does not
need to be rooted and the system does need to have the adb tool in the PATH
environment variable;
+ <2>: Check all third-party APK packages from the USB-connected Android device
against VirusTotal using Public API (slower because of 60 seconds delay for each
4 hashes). Notes: the Android device does not need to be rooted and the system
does need to have adb tool in the PATH environment variable;
+ <3>: Check all third-party APK packages from the USB-connected Android device
against VirusTotal using multithreads (only for Private Virus API). Notes: the
Android device does not need to be rooted and the system needs to have adb tool
in the PATH environment variable;
+ <4> Sends an third-party APK from your USB-connected Android device to
Hybrid Analysis;
+ 5. Sends an third-party APK from your USB-connected Android device to Virus-Total.
-Y ANDROID_ARG, --android_arg ANDROID_ARG
+ This option provides the argument for -y from ANDROID.
-n ALIENVAULT, --alienvault ALIENVAULT
+ Checks multiple information from ALIENVAULT. The possible values are:
+ 1: Get the subscribed pulses;
+ 2: Get information about an IP address;
+ 3: Get information about a domain;
+ 4: Get information about a hash;
+ 5: Get information about a URL.
-N ALIENVAULT_ARGS, --alienvaultargs ALIENVAULT_ARGS
+ Provides argument for -n option from ALIENVAULT. If "-n 1" then -N
must be the number of subscribed pulses to retrieve; If "-n 2" then -N
must be an IP address; If "-n 3" then -N must be a domain; If "-n 4"
then -N must be a hash (MD5/SHA256); If "-n 5" then -N must be a URL.
-m MALPEDIA, --malpedia MALPEDIA
+ This option is related to MALPEDIA and presents different meanings depending on
the chosen value. Thus:
+ 1: List meta information for all families;
+ 2: List all actors ID;
+ 3: List all available payloads organized by family from Malpedia;
+ 4: Get meta information from an specific actor, so it is necessary to use
the -M option. Additionally, try to confirm the correct actor ID by executing
malwoverview with option -m 3;
+ 5: List all families IDs;
+ 6: Get meta-information from an specific family, so it is necessary to
use the -M option. Additionally, try to confirm the correct family ID by
executing malwoverview with option -m 5;
+ 7: Get a malware sample from malpedia (zip format -- password: infected).
It is necessary to specify the requested hash by using -M option;
+ 8: Get a zip file containing Yara rules for a specific family
(get the possible families using -m 5), which must be specified by using -M option;
+ 9: Get a zip file containing the complete Malpedia Yara ruleset for a
TLP level, which must be given with -M as one of tlp_white, tlp_green,
tlp_amber or auto (the short forms white, green and amber are also
accepted). Combine it with --yara to scan with the downloaded rules.
-M MALPEDIAARG, --malpediarg MALPEDIAARG
+ Provides argument for -m option from MALPEDIA. If "-m 4" then -M must
be an actor name (confirm with -m 2); If "-m 6" then -M must be a
family name (confirm with -m 5); If "-m 7" then -M must be a hash to
download the sample; If "-m 8" then -M must be a family name to get
YARA rules.
-b BAZAAR, --bazaar BAZAAR
+ Checks multiple information from MALWARE BAZAAR and THREATFOX. The possible
values are:
+ 1: (Bazaar) Query information about a malware hash sample;
+ 2: (Bazaar) Get information and a list of malware samples associated
and according to a specific tag;
+ 3: (Bazaar) Get a list of malware samples according to a given imphash;
+ 4: (Bazaar) Query latest malware samples;
+ 5: (Bazaar) Download a malware sample from Malware Bazaar by providing a
SHA256 hash. The downloaded sample is zipped using the following
password: infected;
+ 6: (ThreatFox) Get current IOC dataset from last x days given by
option -B (maximum of 7 days);
+ 7: (ThreatFox) Search for the specified IOC on ThreatFox given by option -B;
+ 8: (ThreatFox) Search IOCs according to the specified tag given by option -B;
+ 9: (ThreatFox) Search IOCs according to the specified malware family provided by
option -B;
+ 10. (ThreatFox) List all available malware families.
+ 11: (Bazaar) Batch hash check from a file (one hash per line)
against Malware Bazaar;
+ 12: (Bazaar) Directory scan — computes SHA256 for each file in a
directory and checks against Malware Bazaar;
+ 13: (Bazaar) Search samples matching the YARA rule name given by
option -B. Rule names are listed at the end of a hash report
(-b 1), and are also the rule names inside the YARAify set
downloaded with -b 14 and extracted with -b 15;
+ 14: (YARAify) Download the YARAify rule set (abuse.ch), which is the
rule set behind Malware Bazaar;
+ 15: (YARAify) Extract the downloaded YARAify rule set into a rules
directory that can be given to --yara.
-B BAZAAR_ARG, --bazaararg BAZAAR_ARG
+ Provides argument to -b MALWARE BAZAAR and THREAT FOX option:
+ "-b 1" indicates that the -B's argument must be a hash and a report about
the sample will be retrieved;
+ "-b 2" indicates that -B's argument must be a malware tag and last samples
matching this tag will be shown;
+ "-b 3" means that the argument given by -M must be a imphash and last samples
matching this impshash will be shown;
+ "-b 4" means that the argument given by -M must be "100 or time", where "100"
lists last "100 samples" and "time" lists last samples added to Malware Bazaar
in the last 60 minutes;
+ "-b 5" means that the sample will be downloaded and -B's argument must be
a SHA256 hash of the sample that you want to download from Malware Bazaar;
+ "-b 6" indicates that a list of IOCs will be retrieved and the -B's value
is the number of DAYS to filter such IOCs. The maximum time is 7 (days);
+ "-b 7" indicates that the -B's argument is the IOC you want to search for;
+ "-b 8" indicates that the -B's argument is the IOC's TAG that you want
search for;
+ "-b 9" indicates that the -B argument is the malware family that you want
to search for IOCs;
-x TRIAGE, --triage TRIAGE
+ Provides information from TRIAGE according to the specified value:
+ 1: this option gets sample's general information by providing an
argument with -X option in the following possible formats:
- sha256:<value>
- sha1:<value>
- md5:<value>
- family:<value>
- score:<value>
- tag:<value>
- url:<value>
- wallet:<value>
- ip:<value>;
+ 2: Get a sumary report for a given Triage ID (got from option -x 1);
+ 3: Submit a sample for analysis;
+ 4: Submit a sample through a URL for analysis;
+ 5: Download sample specified by the Triage ID;
+ 6: Download pcapng file from sample associated to given Triage ID;
+ 7: Get a dynamic report for the given Triage ID (got from option -x 1);
+ 8: Batch hash check from a file (one hash per line) against Triage;
+ 9: Directory scan — computes SHA256 for each file in a directory
and checks against Triage.
-X TRIAGE_ARG, --triagearg TRIAGE_ARG
+ Provides argument for -x option from TRIAGE. If "-x 1" then -X must
be a search query (e.g., sha256:<hash>, family:<name>, tag:<tag>,
ip:<ip>); If "-x 2" then -X must be a Triage sample ID (obtained from
-x 1); If "-x 3" then -X must be a file path to submit; If "-x 4"
then -X must be a URL to submit; If "-x 5" or "-x 6" then -X must be
a Triage sample ID to download; If "-x 7" then -X must be a Triage
sample ID for dynamic report; If "-x 8" then -X must be a file
containing hashes (one per line); If "-x 9" then -X must be a directory
path to scan.
-O OUTPUTDIR, --output-dir OUTPUTDIR
+ Set output directory for all sample downloads.
-ip IP, --ip IP
+ Get IP information from various sources. The possible values are:
+ 1: Get details for an IP address provided with -IP from IPInfo;
+ 2: Removed in 8.1.0 (BGPView shut down);
+ 3: Get details for an IP address provided with -IP from all
available intel services (VirusTotal/Alienvault);
+ 4: Get details for an IP address from Shodan;
+ 5: Get details for an IP address from AbuseIPDB;
+ 6: Get details for an IP address from GreyNoise;
+ 7: Get details for an IP address from all services (comprehensive);
+ 8: Batch check IP addresses from a file (one per line) against
VirusTotal and show a summary table (IP Address, Country, AS Owner,
Detection). Use -D to choose between Public (-D 1) and Premium
(-D 0, default) VT API.
-IP IPARG, --iparg IPARG
+ Provides an argument for the -ip option. For -ip 1 through 7 it
must be a valid IP address (IPv4 or IPv6); for -ip 8 it must be a
file containing IP addresses (one per line).
-s SHODAN, --shodan SHODAN
+ SHODAN options:
+ 1: IP lookup;
+ 2: Search query.
-S SHODAN_ARG, --shodanarg SHODAN_ARG
+ Provides argument for -s option from SHODAN. If "-s 1" then -S must
be an IP address; If "-s 2" then -S must be a search query (e.g.,
"apache", "port:22 country:BR").
-ab ABUSEIPDB, --abuseipdb ABUSEIPDB
+ ABUSEIPDB options:
+ 1: Check IP reputation.
-AB ABUSEIPDB_ARG, --abuseipdbarg ABUSEIPDB_ARG
+ Provides an IP address for -ab option from ABUSEIPDB.
-gn GREYNOISE, --greynoise GREYNOISE
+ GREYNOISE options:
+ 1: Quick IP check (community API).
-GN GREYNOISE_ARG, --greynoisearg GREYNOISE_ARG
+ Provides an IP address for -gn option from GREYNOISE.
-wh WHOIS, --whois WHOIS
+ WHOIS options:
+ 1: Domain whois lookup;
+ 2: IP whois/RDAP lookup.
-WH WHOIS_ARG, --whoisarg WHOIS_ARG
+ Provides argument for -wh option from WHOIS. If "-wh 1" then -WH must
be a domain name; If "-wh 2" then -WH must be an IP address.
-ct CRTSH, --crtsh CRTSH
+ Queries the Certificate Transparency logs through crt.sh, which needs
no API key. Possible values:
+ 1: lists the distinct DNS names seen in the certificates issued for
the domain given with -CT, which is a cheap way of enumerating
subdomains. Names belonging to other domains, which appear because a
certificate can cover several tenants, are counted and reported
separately;
+ 2: lists the certificates themselves (identifier, issuer, common
name and validity dates, newest first).
-CT CRTSH_ARG, --crtsharg CRTSH_ARG
+ Provides the domain name queried by the -ct option.
-u URLSCANIO, --urlscanio URLSCANIO
+ URLSCAN.IO options:
+ 1: Submit a URL for scanning;
+ 2: Get scan result by UUID;
+ 3: Search scans using Elasticsearch query syntax
(e.g., "page.server:nginx", "task.tags:phishing");
+ 4: Search scans by domain;
+ 5: Search scans by IP.
-U URLSCANIO_ARG, --urlscanioarg URLSCANIO_ARG
+ Provides argument for -u option from URLSCAN.IO. If "-u 1" then -U
must be a URL to submit for scanning; If "-u 2" then -U must be a UUID
(obtained from -u 1); If "-u 3" then -U must be an Elasticsearch query
(e.g., "page.server:nginx", "task.tags:phishing"); If "-u 4" then -U
must be a domain; If "-u 5" then -U must be an IP address.
--correlate-hash HASH
+ Cross-service hash correlation: queries a hash across VirusTotal,
Hybrid Analysis, Triage, and AlienVault producing a consolidated report.
--extract-iocs SOURCE
+ Extract IOCs (hashes, IPs, URLs, domains, emails, CVEs) from a file
(.txt, .pdf, .eml) or URL (http/https).
PDF extraction requires: pip install malwoverview[pdf]
--yara RULES_FILE
+ YARA rules file to use for scanning. Must be used with --yara-target.
Requires: pip install malwoverview[yara]
--yara-target TARGET
+ File or directory to scan with YARA rules.
--peinfo TARGET
+ Local PE triage of a file or directory (no API key): file type, size,
overlay, overlay size and entropy. Directories are scanned recursively.
Entropy is the highest PE section entropy, or the whole-file Shannon
entropy for non-PE files.
--entropy-threshold VALUE
+ Entropy value at which --peinfo highlights a file as packed or
encrypted. Default: 7.0
--sigcheck TARGET
+ Check the Authenticode signature of a file or directory (no API key):
status, signer, issuer, certificate dates, digest algorithm, certificate
thumbprint and serial number. The status is one of VALID, TAMPERED,
UNTRUSTED, EXPIRED, MALFORMED, INVALID, NONE (no embedded signature),
PRESENT (a signature is there but was not verified) or N/A (not a PE
file). Only embedded signatures are read: a file reported as NONE can
still be signed through a Windows catalog.
Full verification requires: pip install malwoverview[signature]
VALID means the file still matches the certificate it was signed with.
It is not a verdict on the file: signing certificates are stolen,
abused and issued by mistake, and malware has carried valid Microsoft
signatures. An embedded signature is stored in the overlay, so a signed
file always reports one and that overlay is not an appended payload.
Certificate revocation is not checked. No network request is made, so a
file signed with a certificate that was revoked afterwards still
reports VALID.
A signature stays VALID after its certificate expires when it carries a
countersignature, because the countersignature proves the file was
signed while the certificate was still valid. This is how Authenticode
is meant to work, and the report says so when it happens: an expiry
date in the past next to VALID is not a contradiction.
A file can carry more than one embedded signature, usually SHA-1 for
compatibility plus SHA-256, and the signers frequently differ. The
Signer column shows one of them and marks the rest as (+N); running
--sigcheck on a single file lists every signature with its own digest
algorithm, certificate, thumbprint and serial number.
--no-signature
+ Skip signature verification in --peinfo and --sigcheck, reporting
only whether a signature is present. Useful on large directories.
--sig-verify-mode MODE
+ Which embedded signature decides the status of a multi-signed file:
any, first, all or best. Default: best
best follows the signature made with the strongest digest algorithm,
which is the one Windows honours. first follows file order, matching
sigcheck.exe. all requires every signature to verify, and any accepts
the file when a single one does. The choice matters: across 517
multi-signed drivers, 37 change status depending on this setting, and
any reports VALID on 21 files that first rejects.
--attack-map
+ Enable MITRE ATT&CK technique mapping for behavior reports.
GENERAL OPTIONS:
Output format, proxy, cache, and verbosity options
--output-format text|json|csv
+ Output format: text (default, colored terminal), json, or csv.
--proxy URL
+ HTTP/HTTPS/SOCKS5 proxy URL (e.g., socks5://127.0.0.1:9050).
--quiet
+ Suppress banner and cosmetic output.
--verbose
+ Show debug information (request URLs, timing, etc.).
--no-cache
+ Disable result caching.
--cache-ttl SECONDS
+ Cache time-to-live in seconds (default: 3600).
--cache-stats
+ Show the local result cache location, how many entries it holds, how many
of them are expired under the current --cache-ttl, and its size on disk.
Then exit.
--prune-cache
+ Delete only the expired entries from the local result cache (according to
--cache-ttl) and exit.
--clear-cache
+ Delete every entry from the local result cache and exit.
--no-resolve
+ Do not resolve or geolocate the host names found in the results. Listing a
feed (for example the URLHaus payloads and tag listings) normally makes your
host look up every URL it shows, which tells the operator of that
infrastructure that it is being investigated. With this option the location
column shows "Not Resolved" instead.
--defang
+ Print the IOCs listed by --extract-iocs in defanged form
(hxxp://example[.]com), so they can be copied into a report or a ticket
without becoming clickable. It applies to that listing only, and changes
only the output: the queries are still made with the real values.
--no-ioc-filter
+ Turn off the noise filtering that --extract-iocs applies by default.
Normally an HTML page has its <script>, <style> and <svg> blocks skipped,
a domain is only reported when its last label is a real top-level domain,
and links back to the source site or to known page furniture (analytics,
fonts, social buttons) are dropped. With this option every regex match in
the raw source is reported instead.
--report html|pdf
+ Generate a report in the specified format.
PDF export requires: pip install malwoverview[pdf]
--report-file PATH
+ Output path for the generated report.
--interactive
+ Launch interactive REPL mode.
--tui
+ Launch TUI (Text User Interface) dashboard mode with service selector,
query input, and scrollable results panel. Requires: pip install malwoverview[tui]
--enrich
+ Enable LLM enrichment of results. Appends an AI-generated threat assessment
after each query result. Works with all query types including malware hash
lookups, IP reputation checks, CVE searches (NIST and VulnCheck), and
cross-service correlation. Uses the provider configured in .malwapi.conf
[LLM] section, or overridden with --llm. Supported providers:
- claude: Anthropic Claude API (best quality, paid)
- gemini: Google Gemini API (requires billing)
- openai: OpenAI API (paid, GPT models)
- ollama: Local Ollama instance (free, private)
--llm PROVIDER
+ Override the LLM provider for enrichment (use with --enrich).
Examples:
malwoverview -v 8 -V <hash> --enrich --llm claude
malwoverview --nist 2 --NIST CVE-2024-3400 --enrich --llm claude
malwoverview -vc 3 -VC CVE-2024-3400 --enrich --llm ollama
VULNERABILITY OPTIONS:
Vulnerability database query options
NIST CVE Database Query:
Query options for NIST CVE database (Query type and value are required; other options are optional)
--nist NIST_OPTION, Query type: 1=CPE/Product Search, 2=CVE ID Search,
3=CVSS v3 Severity, 4=Keyword Search, 5=CWE ID Search,
6=Component Search (name or path to a local binary)
--NIST NIST_ARG Search value (format depends on query type)
--time YEARS Limit results to last N years
--rpp NUM NVD page size used while paginating (default: 2000, max: 2000)
--startindex NUM Pagination start index (default: 0)
--ncves NUM Limit output to first N CVEs (--nist 6 lists the 25 most
recent by default; 0 lists all)
--sort-by KEY Order --nist results by cve (the CVE ID year, default) or
published (the NVD publication date). --time bounds results
by the same reference
VulnCheck Database Query:
Query options for VulnCheck vulnerability database (Community/Free tier)
-vc VULNCHECK_OPTION, --vulncheck VULNCHECK_OPTION
+ Query type:
1: List available indexes;
2: Get KEV (Known Exploited Vulnerabilities);
3: Search CVE in KEV;
4: Get KEV backup link;
5: List MITRE CVEs;
6: List NIST NVD2 CVEs;
7: Search CVE in MITRE;
8: Search CVE in NIST NVD2.
-VC VULNCHECK_ARG, --VULNCHECK VULNCHECK_ARG
+ Search value (CVE ID for options 3/7/8, max results for options
2/5/6, e.g., 50).
SUBCOMMANDS
Starting in version 8.0, Malwoverview supports an alternative subcommand syntax
alongside the traditional flag-based syntax. Both syntaxes are fully supported
and produce identical results.
Available subcommands:
vt VirusTotal operations (file, av, hash, url, ip, domain, submit, behavior, batch)
ha Hybrid Analysis operations (report, submit, download, batch, dir)
bazaar Malware Bazaar operations (hash, tag, download, batch, dir)
triage Triage operations (search, summary, submit, dynamic, batch, dir)
urlhaus URLHaus operations (hash, url, tag, download, batch)
ip IP address lookups (info, shodan, abuse, greynoise, all, batch)
whois Whois/RDAP lookups (domain, ip)
shodan Shodan operations (ip, search)
correlate Cross-service correlation (hash)
extract IOC extraction from files or URLs
yara YARA rule scanning
nist NIST CVE database queries
vulncheck VulnCheck database queries
Subcommand examples (equivalent to flag-based syntax):
# These pairs are equivalent:
malwoverview vt hash <sha256> # same as: malwoverview -v 8 -V <sha256>
malwoverview vt behavior <sha256> # same as: malwoverview -v 12 -V <sha256>
malwoverview ha report <hash> --env 3 # same as: malwoverview -a 3 -A <hash>
malwoverview ha batch <hashfile> # same as: malwoverview -a 12 -A <hashfile>
malwoverview bazaar hash <sha256> # same as: malwoverview -b 1 -B <sha256>
malwoverview bazaar batch <hashfile> # same as: malwoverview -b 11 -B <hashfile>
malwoverview bazaar dir <directory> # same as: malwoverview -b 12 -B <directory>
malwoverview triage search sha256:<value> # same as: malwoverview -x 1 -X sha256:<value>
malwoverview triage batch <hashfile> # same as: malwoverview -x 8 -X <hashfile>
malwoverview ip all <ipaddr> # same as: malwoverview -ip 7 -IP <ipaddr>
malwoverview ip shodan <ipaddr> # same as: malwoverview -ip 4 -IP <ipaddr>
malwoverview ip batch <ipfile> # same as: malwoverview -ip 8 -IP <ipfile>
malwoverview whois domain <domain> # same as: malwoverview -wh 1 -WH <domain>
malwoverview correlate hash <sha256> # same as: malwoverview --correlate-hash <sha256>
malwoverview extract <file|url> # same as: malwoverview --extract-iocs <file|url>
malwoverview yara <rules> <target> # same as: malwoverview --yara <rules> --yara-target <target>
malwoverview nist 2 CVE-2021-44228 # same as: malwoverview --nist 2 --NIST CVE-2021-44228
Use --help with any subcommand for details:
malwoverview vt --help
malwoverview ip --help
malwoverview ha report --help
EXAMPLES
MALWARE OPTIONS:
malwoverview -d /home/remnux/malware/windows_2/
malwoverview -v 1 -V 95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.exe
malwoverview -v 2 -V 95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.exe
malwoverview -v 3 -V 95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.exe
malwoverview -v 4 -V 95a8370c36d81ea596d83892115ce6b90717396c8f657b17696c7eeb2dba1d2e.exe,
malwoverview -v 5 -V http://jamogames.com/templates/JLHk/
malwoverview -v 6 -V 185.220.100.243
malwoverview -v 7 -V xurl.es
malwoverview -v 8 -V ab4d6a82cafc92825a0b88183325855f0c44920da970b42c949d5d5ffdcc0585
malwoverview -v 9 -V cc2d791b16063a302e1ebd35c0e84e6cf6519e90bb710c958ac4e4ddceca68f7.exe
malwoverview -v 10 -V /home/remnux/malware/hash_list_3.txt
malwoverview -v 11 -V /home/remnux/malware/hash_list_3.txt
malwoverview -v 12 -V 9d26e19b8fc5819b634397d48183637bacc9e1c62d8b1856b8116141cb8b4000
malwoverview -v 13 -V /largefiles/4b3b46558cffe1c0b651f09c719af2779af3e4e0e43da060468467d8df445e93
malwoverview -v 14 -V /home/remnux/rules/apt_rules.yar
malwoverview -v 14 -V /home/remnux/rules/
malwoverview -v 15
malwoverview -v 16 -V 1712345678-abcdef0123456789
malwoverview -v 17 -V 1712345678-abcdef0123456789
malwoverview -v 18 -V /home/remnux/rules/livehunt.yar
malwoverview -v 19
malwoverview -v 20
malwoverview -a 1 -A 2e1fcadbac81296946930fe3ba580fd0b1aca11bc8ffd7cefa19dea131274ae8
malwoverview -a 1 -A 2e1fcadbac81296946930fe3ba580fd0b1aca11bc8ffd7cefa19dea131274ae8.exe
malwoverview -a 2 -A 2e1fcadbac81296946930fe3ba580fd0b1aca11bc8ffd7cefa19dea131274ae8
malwoverview -a 3 -A 2e1fcadbac81296946930fe3ba580fd0b1aca11bc8ffd7cefa19dea131274ae8
malwoverview -a 4 -A malware1.apk
malwoverview -a 4 -A 82eb6039cdda6598dc23084768e18495d5ebf3bc3137990280bc0d9351a483eb
malwoverview -a 5 -A 2b03806939d1171f063ba8d14c3b10622edb5732e4f78dc4fe3eac98b56e5d46
malwoverview -a 5 -A 2b03806939d1171f063ba8d14c3b10622edb5732e4f78dc4fe3eac98b56e5d46.elf
malwoverview -a 6 -A 47eccaaa672667a9cea23e24fd702f7b3a45cbf8585403586be474585fd80243.exe
malwoverview -a 7 -A 47eccaaa672667a9cea23e24fd702f7b3a45cbf8585403586be474585fd80243.exe
malwoverview -a 8 -A 47eccaaa672667a9cea23e24fd702f7b3a45cbf8585403586be474585fd80243.exe
malwoverview -a 9 -A malware_7.apk
malwoverview -a 10 -A 925f649617743f0640bdfff4b6b664b9e12761b0e24bbb99ca72740545087ad2.elf
malwoverview -a 11 -A cd856b20a5e67a105b220be56c361b21aff65cac00ed666862b6f96dd190775e
malwoverview -a 12 -A /home/remnux/malware/hash_list.txt
malwoverview -a 13 -A /home/remnux/malware/samples/
malwoverview -l 1 -L d3dcc08c9b955cd3f68c198e11d5788869d1b159dc8014d6eaa39e6c258123b0
malwoverview -l 2
malwoverview -l 3
malwoverview -l 4
malwoverview -l 5
malwoverview -l 6
malwoverview -l 8 -L PE32
malwoverview -j 1 -J 7c99d644cf39c14208df6d139313eaf95123d569a9206939df996cfded6924a6
malwoverview -j 2 -J 7c99d644cf39c14208df6d139313eaf95123d569a9206939df996cfded6924a6
malwoverview -j 3 -J https://unada.us/acme-challenge/3NXwcYNCa/
malwoverview -j 4 -J Qakbot
malwoverview -j 5 -J Emotet
malwoverview -j 5 -J Icedid
malwoverview -j 6
malwoverview -j 7
malwoverview -j 8 -J /home/remnux/malware/hash_list.txt
malwoverview -p 1 -P 1999ba265cd51c94e8ae3a6038b3775bf9a49d6fe57d75dbf1726921af8a7ab2
malwoverview -p 2 -P 301524c3f959d2d6db9dffdf267ab16a706d3286c0b912f7dda5eb42b6d89996.exe
malwoverview -p 3 -P 68c11ef39769674123066bcd52e1d687502eb6c4c0788b4f682e8d31c15e5306
malwoverview -p 4 -P 68c11ef39769674123066bcd52e1d687502eb6c4c0788b4f682e8d31c15e5306.exe
malwoverview -p 5 -P 188.40.75.132
malwoverview -p 6 -P covid19tracer.ca
malwoverview -p 7 -P http://ksahosting.net/wp-includes/utf8.php
malwoverview -p 8 -P Qakbot
malwoverview -y 1
malwoverview -y 2
malwoverview -y 3
malwoverview -y 4 -Y com.spaceship.netprotect
malwoverview -y 5 -Y com.mwr.dz
malwoverview -v 1 -V 368afeda7af69f329e896dc86e9e4187a59d2007e0e4b47af30a1c117da0d792.apk
malwoverview -n 1 -N 10
malwoverview -n 2 -N 176.57.215.100
malwoverview -n 3 -N threesmallhills.com
malwoverview -n 4 -N 6d1756aa6b45244764409398305c460368d64ff9 -o 0
malwoverview -n 5 -N http://ksahosting.net/wp-includes/utf8.php
malwoverview -m 1 | more
malwoverview -m 2 | more
malwoverview -m 3 | more
malwoverview -m 4 -M apt41 | more
malwoverview -m 5 | more
malwoverview -m 6 -M win.qakbot
malwoverview -m 7 -M 3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d
malwoverview -m 8 -M win.qakbot
malwoverview -m 9 -M tlp_white
malwoverview -m 9 -M tlp_green
malwoverview -b 1 -B c9d7b5d06cd8ab1a01bf0c5bf41ef2a388e41b4c66b1728494f86ed255a95d48
malwoverview -b 2 -B Revil | more
malwoverview -b 3 -B f34d5f2d4577ed6d9ceec516c1f5a744
malwoverview -b 4 -B 100
malwoverview -b 4 -B time | more
malwoverview -b 5 -B bda50ff249b947617d9551c717e78131ed32bf77db9dc5b7591d3e1af6cb2f1a
malwoverview -b 6 -B 3 | more
malwoverview -b 7 -B 193.150.103.37:21330
malwoverview -b 8 -B Magecart | more
malwoverview -b 9 -B "Cobalt Strike"
malwoverview -b 10 | more
malwoverview -x 1 -X score:10 | more
malwoverview -x 1 -X 71382e72d8fb3728dc8941798ab1c180493fa978fd7eadc1ab6d21dae0d603e2
malwoverview -x 2 -X 220315-qxzrfsadfl
malwoverview -x 3 -X cd856b20a5e67a105b220be56c361b21aff65cac00ed666862b6f96dd190775e
malwoverview -x 4 -X http://ztechinternational.com/Img/XSD.exe
malwoverview -x 5 -X 220315-xmbp7sdbel
malwoverview -x 6 -X 220315-xmbp7sdbel
malwoverview -x 7 -X 220315-xmbp7sdbel
malwoverview -ip 1 -IP 8.8.8.8
malwoverview -ip 3 -IP 8.8.8.8
malwoverview -b 5 -B <hash> -O <directory>
malwoverview -b 11 -B /home/remnux/malware/hash_list.txt
malwoverview -b 12 -B /home/remnux/malware/samples/
malwoverview -b 13 -B Windows_Trojan_Emotet
malwoverview -b 14
malwoverview -b 15
malwoverview -x 8 -X /home/remnux/malware/hash_list.txt
malwoverview -x 9 -X /home/remnux/malware/samples/
malwoverview -ip 4 -IP 8.8.8.8
malwoverview -ip 5 -IP 8.8.8.8
malwoverview -ip 6 -IP 8.8.8.8
malwoverview -ip 7 -IP 8.8.8.8
malwoverview -ip 8 -IP /home/remnux/malware/ip_list.txt
malwoverview -ip 8 -IP /home/remnux/malware/ip_list.txt -D 1
malwoverview -s 1 -S 8.8.8.8
malwoverview -s 2 -S "apache"
malwoverview -ab 1 -AB 185.220.100.243
malwoverview -gn 1 -GN 185.220.100.243
malwoverview -wh 1 -WH example.com
</directory></hash></target></rules></target></rules></file></file></sha256></sha256></domain></domain></ipfile></ipfile></ipaddr></ipaddr></ipaddr></ipaddr></hashfile></hashfile></value></value></directory></directory></hashfile></hashfile></sha256></sha256></hashfile></hashfile></hash></hash></sha256></sha256></sha256></sha256></hash></svg></style></script></ip></tag></name></hash></value></value></value></value></value></value></value></value></value></seconds></url></any></file></value></file></target></rules></file></hash></arg></domain></arg></arg></arg></arg></argument></argument></output></ip></arg></arg></argument></argument></file></polyswarm></urlhaus></hash></filename></virustotal></directory></api></value></attribute></hash></hash></hash>
README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。
评论