Free source-available static EXE/DLL analysis tool — looking for feedback

[Bicurico]

I built a small free source-available Windows tool called VMA File Behaviour Scanner:

https://github.com/bicurico/VMAFileBehaviourScanner

I am the author of the tool.

It is not an antivirus and it does not try to decide whether a file is “clean” or “malware”.

The goal is more limited: it gives a local second opinion for individual EXE/DLL files, especially when VirusTotal or similar services show a small number of generic/heuristic detections.

This happens quite often with small Windows utilities, unsigned tools, protected/licensed software, obfuscated .NET applications, firmware tools, reverse-engineering tools, etc.

The scanner performs static analysis only. It does not upload, execute, delete, quarantine or modify files.

Current features:

- SHA256 / MD5 calculation
- PE metadata and section analysis
- entropy analysis
- import table behaviour classification
- suspicious string indicators
- registry / filesystem / network / process execution indicators
- TXT report export
- JSON XREF-style export for deeper manual reverse-engineering analysis

The reason I made it is that I often see legitimate protected or obfuscated software being flagged by a few engines with generic names such as “Trojan.Generic”, “ML.Heuristic”, etc.

I wanted a tool that explains why a file may look suspicious instead of just showing a scary label.

Example output is more like:

“PowerShell-related string found”
“Network API imported”
“Autorun registry path referenced”
“High entropy executable section”

rather than:

“Malware detected.”

I would appreciate feedback, especially from people who have experience with Windows tools, firmware utilities, reverse engineering, malware analysis, or false positives:

- Are the categories useful?
- Is the scoring too conservative or too aggressive?
- What static indicators should be added or removed?
- Is the report wording clear enough to avoid false certainty?
- Would this be useful when checking small downloaded Windows tools before running them?

Again: this is a static triage / second-opinion tool, not an AV replacement.