🛡️ MalwareBox — Malware Analysis Sandbox

A Python-based malware analysis sandbox with a web dashboard for analysing suspicious files — without executing them. Built as a cybersecurity portfolio project.

---

✨ What It Does

Drop any suspicious file into the dashboard and MalwareBox will:

• 🔑 Hash it — MD5, SHA-1, SHA-256 fingerprints for VirusTotal lookups
• 🌡️ Measure entropy — high entropy (>7.2) means the file may be packed or encrypted
• 🔍 Extract strings — pulls readable text from binary files
• 🚩 Find IOCs — hardcoded IPs, URLs, registry keys, base64 payloads
• ⚙️ Monitor behaviour — syscall tracing via strace (Linux)
• 📊 Score the risk — 0–100 risk score with detailed flags
• 💾 Save reports — JSON reports saved automatically for every scan

---

🖥️ Dashboard

The web UI lets you drag & drop any file and see results instantly:

Feature	Description
Drag & drop upload	Drop files directly onto the dashboard
Live progress bar	Real-time analysis progress
Risk score display	Colour-coded 0–100 risk rating
IOC panel	All indicators of compromise in one view
Risk flags	Plain-English explanation of every finding
Analysis history	All previous scans saved and accessible

---

🚀 Quick Start

Requirements

• Python 3.8+
• Windows / Linux

Install & Run

# 1. Clone the repo
git clone https://github.com/Lovedipsingh/Malwarebox.git
cd Malwarebox

# 2. Install dependencies
pip install flask

# 3. Launch (Windows — just double-click)
launch.bat

# 3. Launch (Linux/Mac)
python app.py

Then open http://localhost:5000 in your browser.

---

📁 Project Structure

Malwarebox/
├── app.py                      # Flask web server & API
├── launch.bat                  # Windows one-click launcher
├── setup.bat                   # Windows first-time setup
├── sandbox/
│   ├── static_analyzer.py      # Core analysis engine
│   ├── dynamic_monitor.py      # Runtime syscall tracing
│   ├── network_capture.py      # Packet analysis
│   └── report_generator.py     # JSON report output
└── templates/
    └── index.html              # Web dashboard UI

---

🔬 How The Analysis Works

Static Analysis (safe — no execution)

1. Reads the raw file bytes
2. Computes cryptographic hashes → paste into VirusTotal
3. Calculates Shannon entropy → high values = likely encrypted/packed
4. Extracts readable strings → finds hidden commands and paths
5. Pattern-matches IOCs → IPs, URLs, registry keys, base64 blobs
6. Scores risk 0–100 based on all findings

Dynamic Analysis (Linux only)

1. Wraps the sample in strace
2. Records every system call made during execution
3. Flags dangerous calls: execve, connect, mprotect, ptrace
4. Tracks child processes spawned by the sample
5. Records all file system events

---

⚠️ Safety Notice

Always run this tool inside an isolated VM or container.
Never analyse real malware on your host machine.

---

🗺️ Roadmap

• VirusTotal API integration
• YARA rule scanning
• Docker container support
• PDF report export
• MITRE ATT&CK technique tagging

---

📄 License

MIT License — free to use and modify.

---

Built by Lovedip Singh