Static File Analyzer (SFA)
#Security Testing#Malware Analysis
A Yara ruleset for detecting PHP shells and other webserver malware.
Static File Analyzer (SFA) Overview
The Static File Analyzer (SFA) is a Python-based tool that serves as a connector between ClamAV and YARA rules. It enables in-depth analysis of potentially harmful files.
It can score suspect files and analyze embedded content
It can score suspect files, create visual tree graphs for a quick display of embedded files, calculate indicators of compromise, and extract specific patterns such as URLs, hosts, and IP addresses. SFA utilizes ClamAV to extract embedded files and generate JSON trees, which are then sent to YARA for rule verification.
User-Friendly and Accessible Features
It is user-friendly, available as a Docker image, and includes a web interface that is integrated within an API.
