HORUS โ€” The All-Seeing Eye
๐“‚€ v4.0 ยท Windows 10/11 x64 ยท C++17

Analyze one file. Keep the whole case.

One self-contained .exe for direct malware triage and persistent cases โ€” static PE analysis, explainable similarity clusters, and opt-in threat-intel enrichment. No Python, no installer, zero dependencies.

โฌ‡ Download horus.exe Quick start
Windows x64 C++17 Zero deps MIT License
What is Horus

Analyze a file immediately, or build a persistent case

horus.exe sample.exe runs direct analysis with no case setup. Use --case when you want repeatable analysis across a sample directory.

a file path
Hashes and inventories any file; valid PEs also get parsing, signature checks, capabilities, ATT&CK, UEBA, and a scored verdict
a samples directory
--case inventories up to 5,000 files, preserves state, finds exact duplicates, and clusters related valid PEs
a hash
Classifies MD5, SHA-1 or SHA-256 locally; --enrich opts in to VirusTotal
an IP address
Classifies it locally; --enrich opts in to VirusTotal and AbuseIPDB lookups
a domain / URL
Classifies it locally; --enrich opts in to configured reputation providers
an email
Recognises the indicator and returns UNKNOWN unless a configured provider supports it
Under the hood

Real static analysis, not just a hash lookup

๐Ÿงฎ

Hashing

MD5, SHA-1 and SHA-256 computed via Windows BCrypt/CNG โ€” plus a Mandiant-compatible imphash for family pivoting.

๐Ÿงท

PE parser

PE32 / PE32+ headers, sections and imports โ€” every offset and length bounds-checked, so malformed samples are safe to feed it.

๐ŸŒก๏ธ

Entropy & packing

Per-section Shannon entropy flags packed/encrypted regions and known packers (UPX, Themida, VMProtectโ€ฆ).

๐Ÿง 

Capability scoring

~110 Windows APIs mapped to the capabilities they imply โ€” injection, keylogging, persistence, evasion โ€” and the dangerous combinations.

๐Ÿ—‚๏ธ

Persistent cases

Incremental refresh, verify, rebuild, prune, portable relative paths, and searchable offline exports for directories of up to 5,000 files.

๐Ÿ”—

Explainable similarity

SHA-256 duplicate groups for every file and representative-based PE clusters using TLSH plus structural fingerprints โ€” without claiming a definitive family.

๐Ÿ›ฐ๏ธ

Opt-in enrichment

--enrich sends only hashes and extracted indicators to configured VirusTotal and AbuseIPDB providers. Sample bytes are never uploaded.

๐Ÿงฉ

JSON + exit codes

--json for automation; exit codes distinguish suspicious results, fatal errors, and incomplete or UNKNOWN analysis.

The scoring engine

It interprets imports โ€” it doesn't just list them

Common dual-use APIs (LoadLibrary, CreateProcess) are shown but don't move the score alone. Only rare primitives and dangerous combinations do.

Individual capabilities

Process injection+22
Input capture (keylogger)+20
RWX section+18 ea
Known packer name+16
Persistence+14
Privilege escalation+14
High-entropy section (โ‰ฅ7.2)+12 ea
Screen capture ยท defense evasion+12

Combination bonuses โ€” the important part

Injection + dynamic API resolution+15
Keylogger + networking+15
Crypto + networking (ransomware / C2)+12
โ€ฆcombined with VirusTotal consensus for the final verdictโ†’
0 โ€“ 9
CLEAN

Complete analysis found no concerning evidence.

10 โ€“ 29
LOW RISK

Suspicious imports, no strong signals.

30 โ€“ 59
SUSPICIOUS

Multiple concerning capabilities or combos.

60 โ€“ 100
LIKELY MALICIOUS

Strong evidence of malicious intent.

UNKNOWN is separate from these score bands: it means the available evidence was not sufficient for a scored verdict.

Get started

No install. Download and run.

Download horus.exe from the Releases page
One file. Put it on your PATH, or just run it from any folder.
.\horus.exe suspicious.exe
Full static PE analysis + hashing โ€” works with no API keys at all.
.\horus.exe --case C:\Samples --gui
Create or refresh a portable case and open its searchable offline report.
$env:VT_API_KEY = "โ€ฆ" ; .\horus.exe suspicious.exe --enrich
Optional: explicitly enable live reputation lookups for hashes and extracted indicators.
โฌ‡ Download the latest release Build from source
Safety & limitations

Read-only by design

It never runs the sample. Horus reads sample bytes without executing, copying, modifying, or uploading them. It writes only requested reports, case state, and local cache data.
Malformed samples are safe. The PE parser bounds-checks every offset and length before reading.
A triage aid, not a final verdict. Pair the static score with VirusTotal consensus and, for anything that matters, a sandbox detonation.
Static analysis has limits. Heavily obfuscated samples that resolve imports at runtime score low โ€” that's expected; entropy heuristics only partly compensate.