A Zero-Dependency Forensic Triage Tool for Static Analysis
Imposter Detector is a CLI forensic tool designed to detect file anomalies, obfuscation, and spoofing attempts without executing the file. Unlike traditional tools that rely on fragile external libraries (like libmagic), this tool implements a custom binary sniffer and heuristic engine built entirely in Python standard libraries.
It is designed for Incident Response (IR) triage to quickly scan thousands of files and flag suspicious artifacts.
- 🚫 Zero-Dependency Architecture: Runs on any machine (Windows/Linux/macOS) without installing OS-level headers.
- 🕵️♂️ Manual Binary Sniffer: Detects file types by parsing raw Magic Bytes headers (not file extensions).
- 🎭 De-obfuscation Engine: Automatically detects and cleans CMD evasion techniques (e.g.,
cmd.exe) and Null-byte injection. - 🔓 Payload Extraction: Detects and decodes Base64 encoded PowerShell commands (
-enc) on the fly. - 🧠 Context-Aware Heuristics: Calculates Shannon Entropy to detect packed/encrypted payloads hiding in text scripts.
git clone [https://github.com/rETelect/imposter-detector.git](https://github.com/rETelect/imposter-detector.git)
cd imposter-detector
pip install -r requirements.txt
💻 ## Usage
Scan a single file:
Bash
python3 src/main.py malicious_script.bat
Scan a directory (Recursive) and save report:
Bash
python3 src/main.py ./downloads -v -o report.json
🛡️ ## Detection Capabilities
Extension Spoofing: Flags salary.pdf if the header is actually an Executable (MZ).
Polyglots: Detects appended payloads (e.g., PowerShell script hidden at the end of a JPEG).
Obfuscation: Normalizes streams to catch powershell attacks.
⚠️ ## Engineering Decisions & Limitations
Static Analysis Only: This tool does not execute files. Advanced runtime-packed malware requires dynamic analysis (Sandbox).
Performance: Uses a sliding window with overlap to handle large files efficiently without memory exhaustion.