A Python-based cybersecurity tool that performs static file analysis using file signatures (magic numbers), cryptographic hashing, entropy analysis, and risk assessment techniques commonly used in malware triage and digital forensics.
- Magic Number Detection
- File Type Identification
- Extension Mismatch Detection
- SHA-256 Hash Generation
- Entropy Analysis
- Entropy Classification
- Risk Assessment Engine
- Compressed File Awareness (MP3, ZIP, Images, etc.)
The tool analyzes a file by:
- Reading its binary header.
- Identifying the true file type using magic numbers.
- Comparing the detected file type with the file extension.
- Generating a SHA-256 hash.
- Calculating file entropy.
- Interpreting entropy based on file type.
- Producing a risk assessment.
An attacker may disguise a malicious executable as:
invoice.pdf
Although the extension suggests a PDF document, the file signature may reveal that the file is actually a Windows executable.
The tool detects such discrepancies and flags them for investigation.
File: invoice.pdf
Extension: .pdf
Magic Number: 4D 5A
Detected Type: Windows PE Executable
SHA256: 17035A34337372368D7C40F8278E967626C778650216453E13558D07ACCFC18F
Entropy: 7.96/8.0
Entropy Category: Very High
Analysis: Potentially packed or encrypted executable.
Risk Level: High
Reasons:
- Extension does not match file signature
- Executable file detected
- High entropy may indicate packing or encryption
- Python 3
- hashlib
- pathlib
- collections
- math
- Digital Forensics
- Malware Analysis Fundamentals
- Static File Analysis
- Cryptographic Hashing
- File Signature Analysis
- Risk Assessment
- Python Programming
magic-number-analyzer/
├── scanner.py
├── signatures.py
├── hashing.py
├── entropy.py
├── risk.py
└── README.md
- Batch Directory Scanning
- YARA Rule Support
- Report Generation (CSV/PDF)
- VirusTotal Integration
- Additional File Signature Coverage
Karthik G