Malware codes - static analysis

[snehavarghesemg1997abc]

I would like to know about the option I can choose for malware source code static analysis. VirusTotal and YARA rules are the known ones for me, but VirusTotal only compares hashes; I need to do the check before and after code alterations. Are there any available options?

[ZX41R]

VirusTotal/YARA are the wrong layer for "before vs after source changes". I would split this into two tracks.

For source-level checks, use AST-aware tools: Semgrep/CodeQL for cross-language rules, clang-tidy/cppcheck for C/C++, Bandit/Ruff/Semgrep for Python, gosec/staticcheck for Go. That catches risky patterns before compilation and gives stable diffs when code is edited.

For reverse-engineering style comparison, build both versions with the same compiler flags and compare the artifacts: imports/exports, sections, strings, entropy, capa capabilities, and a structural diff with something like Diaphora/BinDiff/radiff2 depending on the format. diffoscope is also useful when you want to know exactly what changed in a produced package.

For malware specifically, don't trust decompiler names as your primary signal. Prefer bytecode/IR-level patterns and compiled-artifact checks, then use YARA/capa/FLOSS/strings as triage signals rather than final proof.