README.md

# Malware Analysis Dataset

Memory forensics analysis dataset for malware research using Volatility Framework.

## Structure

### Dataset Repository (this repo)
Analysis outputs, scripts, and YARA rules from memory forensics:

```
malware_analysis/
├── Automating_Volatility.py      # Volatility automation script
├── Volshell_Automation.py        # VolShell automation
├── vboxelf.py                    # ELF binary extraction
├── malware_rules.yar             # YARA detection rules
├── completed_files.txt           # Processing log
├── README.md                     # This file
└── Scans/                        # Volatility scan outputs
    ├── malfind/                  # Process memory injection
    ├── pslist/                   # Process listings
    ├── psscan/                   # Process scanning
    ├── pstree/                   # Process trees
    ├── psxview/                  # Cross-view analysis
    ├── yarascan/                 # YARA matches
    └── vadwalk/                  # VAD walk (ransomware)
```

### Raw Data Bucket: `hf://buckets/Vedaang/malware-analysis-data/`
Complete directory structure with all raw files:

```
malware-analysis-data/
├── Benign_Analysis/              # 6 benign memory dumps + ELF + scans
├── Ransomware_Analysis/          # 12 ransomware samples + ELF + scans
├── Scans/                        # All volatility scan outputs
└── Virtual_Machines/             # VM disk images (Ubuntu 64-bit)
```

### Code Base Bucket: `hf://buckets/Vedaang/malware-code-base/`
Source code, research papers, and documentation:

```
malware-code-base/
├── Automating_Volatility.py
├── Volshell_Automation.py
├── Memory_Forensics_Volatility_Yara_Rules.ipynb
├── Research_Paper.pdf
├── Conference Paper/
├── Notes/
├── Reference Files/
└── Presentation and Report/
```

## Sample Categories

### Benign Samples (6)
| File | Description |
|------|-------------|
| `base.raw` / `base.elf` | Baseline clean system |
| `clean.raw` / `clean.elf` | Clean system snapshot |
| `3.raw`–`10.raw` / `3.elf`–`10.elf` | Various benign workloads |

### Ransomware Samples (12)
| Sample | Family |
|--------|--------|
| Annabelle | Annabelle |
| blue_howl | BlueHowl |
| cerber / cerber1 | Cerber |
| GandCrab | GandCrab |
| Jigsaw1 / Jigsaw2 | Jigsaw |
| TeslaCrypt1 | TeslaCrypt |
| Vipasna1 | Vipasna |
| ViraLock | ViraLock |
| WannaCry1 / WannaCry2 | WannaCry |

## Usage

### Analysis Dataset (Hugging Face Dataset)
```bash
hf download Vedaang/malware_analysis
```

### Complete Raw Data (Bucket)
```bash
# Install hf CLI
pip install huggingface_hub[hf_transfer]

# Sync specific categories
hf sync hf://buckets/Vedaang/malware-analysis-data/Benign_Analysis ./benign
hf sync hf://buckets/Vedaang/malware-analysis-data/Ransomware_Analysis ./ransomware
hf sync hf://buckets/Vedaang/malware-analysis-data/Scans ./scans
hf sync hf://buckets/Vedaang/malware-analysis-data/Virtual_Machines ./vms

# Code base
hf sync hf://buckets/Vedaang/malware-code-base ./code
```

### Run Volatility Analysis
```bash
python Automating_Volatility.py -f memory.raw --profile Win10x64_19041
python Volshell_Automation.py -f memory.raw
```

## Analysis Tools
- **Volatility 3** — Memory forensics framework
- **YARA** — Pattern matching for malware identification
- **Custom Python scripts** — Automation wrappers

## Research Context
This dataset was created for the Major Project: "Memory Forensics Analysis of Ransomware using Volatility Framework and YARA Rules"

## Citation
```bibtex
@dataset{malware_analysis_2026,
  author = {Vedaang Chopra},
  title = {Malware Analysis Memory Forensics Dataset},
  year = {2026},
  publisher = {Hugging Face},
  url = {https://huggingface.co/datasets/Vedaang/malware_analysis}
}
```

## License
For research purposes only. Memory dumps contain no sensitive user data.