Malware Analysis System with VirusTotal API, CVE Intelligence & Llama 3.1 LLM

Django Project Implementation

• VirusTotal API (Task 1.1)
• CVE identification & enrichment (Task 1.2)
• Local Llama 3.1 8B model for SOC-grade recommendations (Task 2)

Demo

---

✅ What This System Does

** – Malware Behavior Extraction (VirusTotal)**

For each malware hash, the system retrieves:

• File metadata
• Detection statistics
• Process behavior
• File system changes
• Registry activity
• Network IOCs

---

** – CVE Identification & Threat Intelligence**

Automatically performs:

• CISA report download
• Regex CVE extraction
• Llama-assisted extraction (fallback)
• VirusTotal CVE tags
• Fallback CVE mapping

CVE enrichment from:

• NVD
• CVE.org
• CIRCL

---

** – LLM-Based Cybersecurity Recommendations**

Local Llama-3.1-8B-Instruct produces:

• Threat analysis
• IOCs
• Exploitation flow
• Detection & prevention
• Incident response
• Long-term hardening

---

🖥️ Django Dashboard Features

• Hash input + preset malware buttons
• Detection charts
• Heatmaps
• Behavior tables
• CVE cards
• Full LLM prompt + response

---

🚀 Deployment & Setup

Clone Repo

git clone <your-repo-url>
cd repo

Create Virtual Environment

python3 -m venv venv
source venv/bin/activate

Windows:

.\venv\Scripts\activate

Install Dependencies

pip install -r requirements.txt

Set API Keys

export VT_API_KEY="YOUR_VT_KEY"
export MALWARE_LOG_LEVEL="INFO"   # optional

HuggingFace Login (for Llama)

huggingface-cli login

Run Migrations

python manage.py migrate

Start Server

python manage.py runserver

Open browser:

http://127.0.0.1:8000/

---

📡 API

POST /analyze/

Analyzes malware hash.

Request:

{
  "hash": "<sha256>"
}

Response includes VT data, CVEs, LLM analysis, charts, tables.

---

📚 References

• https://docs.virustotal.com
• https://nvd.nist.gov
• https://www.cve.org
• https://cve.circl.lu/api
• https://ai.meta.com/llama
• https://www.djangoproject.com