Static analysis · Personal project
AntiVirusEngine
A modular static malware scanning engine written in Go. It combines lightweight detection methods, from exact signatures to PE metadata and heuristic indicators.
- Status
- Educational tool
- Source
- View repository
AntiVirusEngine explores how a scanner can combine several weak or narrow static signals without hiding what each one contributes to the final report.
Static scan result
Project media coming soonHow it works
Modular scan pipeline
A central Go engine coordinates hashing, signature matching, YARA, PE analysis and heuristic checks. Each detection records its engine, type, severity, score and explanation.
- MD5, SHA-1 and SHA-256 signature matching
- External YARA CLI integration
- PE32 and PE32+ metadata extraction
- Suspicious imported-symbol matching
- Readable-string and suspicious URL checks
Signals, not certainty
Entropy is treated as a weak indication of packing or encryption rather than automatic proof of malware. Heuristic findings are combined into an educational risk score and a clean, suspicious or malicious label.
Files and reports
The CLI accepts a single file or a directory. Directory scans use worker goroutines, support recursive traversal and aggregate clean, suspicious, malicious and skipped counts into terminal or JSON reports.
Scope
This is a static-analysis learning project. It does not provide the behavioral monitoring, signature updates, quarantine, sandboxing or operational guarantees expected from production antivirus software.
Source code