# a0rtega/pafish

Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do

Repository: https://github.com/a0rtega/pafish
Canonical: https://ross.abutalabs.com/products/pafish
Language: C
License: GPL-3.0
License Family: copyleft
Topics: malware, reverse-engineering, virtual-machine, malware-families, analysis-environments, sandbox, malware-analysis, rdtsc, malware-research
Archived: true
Last push: 2024-06-21T08:49:44+00:00

## Health v2 (maintenance only)
Score: 10/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 5176, "days_push": 803, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: archived
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3946, forks 497 (observed 2026-08-28T04:08:30.279238+00:00)

## What it is
Pafish is a Windows testing tool that applies the same VM and sandbox detection techniques used by malware families to check whether an analysis environment is properly hardened. It is written in C and released as open source under GPL-3.0.

## Use cases
- test if my malware analysis VM is detectable
- check sandbox evasion techniques used by malware
- verify virtual machine hardening for reverse engineering
- study anti-VM detection methods like rdtsc
- audit a malware analysis lab environment

## When to choose
- you run a malware analysis sandbox or VM and want to verify it resists detection
- you are a security researcher studying anti-analysis evasion techniques

## When to avoid
- you need a general-purpose VM or sandbox product
- you need malware detection or antivirus functionality rather than detection testing

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, reverse-engineering, testing
- domain: security, reverse-engineering, developer-tools
- platform: windows, cli
- tags: anti-analysis, vm-detection, sandbox-evasion, malware-analysis, rdtsc

## Member repositories
- a0rtega/pafish (main) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:30.279238+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:24:34.875032+00:00, confidence not recorded.
  - readme: https://github.com/a0rtega/pafish (fetched 2026-08-28T04:08:30.279238+00:00, sha 2cbcdae8da53)
- Data as of 2026-08-30T08:39:29.467469+00:00.