bicurico/vmafilebehaviourscanner

VMA File Behaviour Scanner is a free tool for Windows that examines a single executable file, an EXE or DLL, and reports on what it might do without actually running it. This kind of check is called static analysis, meaning the tool only reads and inspects the file's contents rather than executing it. The README is clear that it does not upload the file anywhere, delete it, quarantine it, or modify it in any way, it simply looks at the file locally on your machine and reports what it finds. It reports on several categories of information: file hashes, which are unique fingerprints used to identify a file, the internal metadata and sections of the Windows executable format, which functions the file imports from other libraries, any suspicious text strings found inside it, and indicators related to the registry, filesystem, network activity, and process execution that the file might touch. It also measures entropy, a statistical property that can hint at whether parts of a file are compressed or encrypted, and can export a JSON file in a format meant to work alongside a related, more advanced reverse-engineering tool called VAXD from the same author. The README is explicit that this is not an antivirus program. It does not claim a file is safe or malicious, it is meant to give someone doing manual review a second opinion and some concrete data points to help judge whether a file looks suspicious. The README does not go into detail about installation steps or how to run the tool day to day, so anyone trying it should expect to explore the interface directly.