Neurosec Malware Scanner - Enhanced Multi-Engine Edition

An advanced malware detection system with 8 real threat intelligence engines for comprehensive malware analysis and threat detection.

🌐 LIVE DEPLOYMENT: https://mern-malware-checker-dv9mkfafd-aditya-pawades-projects.vercel.app

✅ Successfully deployed on Vercel with 8 real API integrations!

🚀 Live Features

• 🌟 Multi-Engine Analysis: 8 real threat intelligence APIs working in parallel
• ⚡ Instant Results: Real-time analysis from multiple security vendors
• 🎯 High Accuracy: Cross-verification across multiple threat databases
• 📊 Comprehensive Reports: Detailed analysis from each security engine
• 🔍 Engine Details: View individual engine results and capabilities

🚀 Features

🎯 Multi-Engine Threat Intelligence

• VirusTotal: Community-based malware detection with 70+ engines
• MalwareBazaar: Fresh malware samples database
• AbuseIPDB: IP reputation and threat intelligence
• MetaDefender: Multi-scanning with 40+ anti-malware engines
• URLVoid: Website safety and reputation checking
• ThreatCrowd: Open source threat intelligence
• Static Analysis: PE file analysis and entropy calculation
• NeuroSec Scanner: Custom AI-powered detection engine

🌟 Enhanced User Experience

• Real-time Analysis: Parallel processing across all engines
• Engine Details Tab: View individual engine capabilities and results
• Professional UI: GitHub Dark theme with responsive design
• Progress Tracking: Real-time status updates during analysis
• Error Handling: Graceful handling of API timeouts and errors
• Cross-Platform: Works on Windows, Mac, and Linux

📋 Prerequisites

• Modern Web Browser (Chrome, Firefox, Safari, Edge)
• Internet Connection (for accessing the live deployment)

For Local Development:

• Node.js (v14 or higher)
• API Keys for threat intelligence engines:
  • VirusTotal API Key (free at VirusTotal)
  • AbuseIPDB API Key (free at AbuseIPDB)
  • MetaDefender API Key (free at MetaDefender)
  • URLVoid API Key (free at URLVoid)

🌐 Using the Live Application

Simply visit: https://mern-malware-checker-dv9mkfafd-aditya-pawades-projects.vercel.app

1. Upload a file or enter a URL for analysis
2. Click "Analyze" to start multi-engine scanning
3. View results from all 8 security engines
4. Check "Engine Details" tab for individual engine information
5. Download report if needed for documentation

🛠️ Quick Setup

Windows Users (Automated Setup):

# Run the automated installation script
INSTALL.bat

# Start both servers
START.bat

Manual Installation:

1. Clone and Setup Backend

cd server

# Install Node.js dependencies
npm install

# Install Python dependencies
pip install -r requirements.txt

2. Setup Frontend

cd client

# Install React dependencies
npm install

3. Environment Configuration

Create .env file in the server/ directory:

VIRUSTOTAL_API_KEY=your_virustotal_api_key_here

🚀 Running the Application

Start Backend Server

cd server
npm start
# Server runs on http://localhost:5001

Start Frontend

cd client
npm start
# React app runs on http://localhost:3000

🔧 Python Dependencies

The scanner requires these Python packages:

• yara-python: YARA rule matching
• pefile: PE file analysis
• python-magic: File type detection
• argparse: Command line parsing

📁 Project Structure

neurosec-malware-scanner/
├── client/                 # React frontend
│   ├── src/
│   │   ├── App.js         # Enhanced UI with structured JSON display
│   │   └── App.css        # GitHub dark theme styling
│   └── package.json
├── server/                 # Node.js backend
│   ├── server.js          # Enhanced Express server with toggle modes
│   ├── scanner.py         # Python static analysis with enhanced output
│   ├── requirements.txt   # Python dependencies
│   ├── rules/             # YARA rules directory
│   │   ├── malware_detection.yar
│   │   └── advanced_detection.yar
│   └── package.json
├── test-files/            # Test files for validation
├── docs/                  # Comprehensive documentation
│   ├── HOW_TO_RUN.md
│   ├── PROJECT_OVERVIEW.md
│   └── ENHANCED_OUTPUT_FORMAT.md
├── INSTALL.bat           # Windows automated setup
├── START.bat             # Windows startup script
└── README.md

🔍 How It Works

1. File Upload: User uploads a file through the React interface
2. Mode Selection: Choose Fast Mode (scanner only, 30s) or Full Mode (VirusTotal + scanner, 3min)
3. VirusTotal Analysis: Backend sends file to VirusTotal API (Full Mode only)
4. Static Analysis: Python scanner analyzes file locally
5. YARA Scanning: Applies custom detection rules
6. Result Combination: Merges VirusTotal and scanner results
7. Structured Display: Shows results with emoji formatting and clear labels

📊 Enhanced Analysis Output

The system provides structured output with:

• 📁 Testing File: File name and details
• ✅ Status: Processing status (200 - Success)
• 🛡️ Verdict: Clean/Suspicious/Malicious with color coding
• ⚠️ Threat Score: Percentage-based threat assessment
• 🏷️ Family: Malware family classification
• 🎯 Confidence: Analysis confidence percentage
• 📋 Explanation: Detailed analysis reasoning

🛡️ Security Features

• Safe Analysis: Files are analyzed without execution
• Temporary Files: Uploaded files are automatically cleaned up
• YARA Rules: Custom detection patterns for various threats
• Multiple Detection: Combines community intelligence with static analysis
• Toggle Modes: Prevents timeout issues with flexible analysis options

🧪 Testing

The project includes comprehensive test files:

• clean_file.txt - Known clean file
• suspicious-script.js - JavaScript with suspicious patterns
• ransomware-simulation.ps1 - PowerShell ransomware simulation
• crypto-miner.py - Cryptocurrency mining script
• And 5 more test files for various scenarios

🔧 Customization

Adding New YARA Rules

Create .yar files in server/rules/ directory:

rule MyCustomRule {
    meta:
        description = "Detects my custom pattern"
        family = "MyMalware.Family"
        severity = "high"
    
    strings:
        $pattern = "suspicious_string"
    
    condition:
        $pattern
}

Extending Analysis

Modify server/scanner.py to add new analysis methods:

• Additional file format support
• New suspicious pattern detection
• Enhanced entropy analysis
• Network artifact detection

🐛 Troubleshooting

Python Dependencies Issues

# Try updating pip first
python -m pip install --upgrade pip

# Install dependencies with verbose output
pip install -r requirements.txt -v

YARA Installation Issues (Windows)

# Install Visual C++ Build Tools if needed
# Then install YARA
pip install yara-python

Permission Issues

# Run with appropriate permissions
sudo pip install -r requirements.txt  # Linux/Mac
# Or use --user flag
pip install --user -r requirements.txt

📝 License

This project is licensed under the ISC License.

👨‍💻 Author

Aditya Pawade - adityapawade30@gmail.com
Suyash Jadhav - jadhavsuyash34@gmail.com
Final Year Project - Neurosec Malware Scanner

🤝 Contributing

1. Fork the repository
2. Create your feature branch
3. Commit your changes
4. Push to the branch
5. Create a Pull Request

⚠️ Disclaimer

This tool is for educational and research purposes. Always follow responsible disclosure practices when analyzing potentially malicious files.