suggestion ? about peframe HOT 2 OPEN

Great idea, but I need to establish a criterion of evaluation. Suggestions?

from peframe.

yep, I was thinking about it. I am not a expert, but I can try to imagine something.
We would have to establish a list of the worst suspecious

1. anti VM tricks ? Why should a software avoid virtualization ? (even in my tests, i found putty had anti VM... I wonder why)
2. Suspicious Sections. Many suspecious sections are often found in malware. maybe if it's > 2, you have a warning, >4 you have a critical
   3)Suspicious API discovered: often seen in malware as in many applcations. I don't know to interpret them...
3. Anti Debug: idem

after that, we can have a mathematical way to calculate the score:
For example : 1 VM trick = coef 10, 3 suspicious sections with coef 3, 25 suspicious API with coef 0.5, 12 anti debug with coef 0.5
total = 10 + 9 + 12.5 + 6 : 37.5

the example is not good enough because you can have 150 suspicious API, and the score will be high.
Be I think that could be possible :)

from peframe.