Malwr is an experiment. Its goal is not just to provide a static malware analyzer, but a larger community platform for people to interact, share data and perform research. After another year of operation (although with its ups and downs), it is interesting to draw some conclusions and crunch some numbers to get an overview of what we've seen so far.

The following table shows the number of occurrences each behavioral signature has recorded complexively across all analysis our service completed. It is an interesting overview of the overall popularity of malicious or non-malicious behavior that Cuckoo was able to identify.

As I've introduced a couple of new signatures just few hours ago and others have been around longer, take these statistics with a grain of salt.

Out of curiosity, I was also interested in getting an overview of the average detection rate recorded through our VirusTotal integration. The following table shows the number of occurrences each detection count recorded across all analysis completed by our service.

For example, the third row means that 6485 files have been detected just by two Antiviruses out of all available on VirusTotal at that specific time (generally between 45 and 55). The first row simply means that at the time of submission to Malwr, the files were not available on VirusTotal.

I'm very well aware that VirusTotal scores are not supposed to be a metric of comparison or of efficiency, but there's an interesting trend shown by these numbers, whatever conclusion you might draw from them.

Also, keep in mind that it is common that non-malicious files are uploaded to the service (for example clean PDF documents are very popular), so the high number of 0 detections isn't in anyway representative.

Let us know if you find this type of information of any value, if you would like to see these statistics calculated more regularly and if you have some additional ideas.