Hi @behnazh-w @tromai,

The latest update to the PR introduces additional suspicious patterns based on the review of over 30 malware data. The analyzer can now identify malicious code sections and store them in a dictionary. However, there is still a need to address the high false positive rate.
The result from scanning argsreq (contains line number and code snippet):
{'OS Detection': {}, 'Code Execution': {271: 'subprocess.call()'}, 'Information Collecting': {}, 'Remote Connection': {265: 'requests.get(url)'}, 'Custom Setup': {}, 'Suspicious Constant': {263: ['https://cdn.discordapp.com/attachments/1227878114533572611/1228362698920562828/ConsoleApplication2.exe?ex=662bc4e9&is=66194fe9&hm=4520192e5a1190c319246c81bf958c1d3e9bb6b4cb69f43a94ccaf7fbdf35fa6&', 'windows.exe']}, 'Obfuscation': {}}

To improve accuracy, the malware analyzer should implement two key enhancements:

1. Analyze data flow to retrieve constant values.
2. Detect and decrypt encoded source code.

Implementing these methods is expected to reduce false positives.

Currently, the malware validator uses AST analysis, which activates only when the heuristic analysis detects suspicious behavior in the package.

Please let me know if you have any concerns, and feel free to share any ideas for the validator! Thanks

Thanks, @Yao-Wen-Chang! We'll merge this PR and make further improvements in the upcoming PRs.