elementmerc/anya repository overview

Anya analyses files without executing them. Drop a PE, ELF, Mach-O, PDF, Office doc, or any file onto the GUI, or pipe files through the CLI. Get hashes, entropy, imports, sections, IOC indicators, MITRE ATT&CK mappings, a confidence-scored verdict, and a risk score. 200+ files per minute, entirely offline.

Anya (AHN-yah) means "eye" in Igbo.

⁠Install

⁠Download

Grab the latest release for your platform:

Download from GitHub Releases →⁠

Also available on SourceForge⁠.

⁠One-liner

curl -fsSL https://raw.githubusercontent.com/elementmerc/anya/main/install.sh | bash

Prompts for CLI, GUI, or both. Or specify directly:

curl -fsSL .../install.sh | bash -s -- --both   # CLI + GUI
curl -fsSL .../install.sh | bash -s -- --cli    # CLI only
curl -fsSL .../install.sh | bash -s -- --gui    # GUI only

⁠Docker

docker pull elementmerc/anya:latest

docker run --rm \
  -v "$(pwd)/samples:/samples:ro" \
  elementmerc/anya:latest \
  --file /samples/malware.exe --json

⁠Building from source

Building from source is not supported for public users. Anya relies on a private git submodule (anya-proprietary) containing the scoring engine and educational data. The public repo includes stub crates that allow the workspace to resolve, but the build will fail without the real content. Use the install script, Docker image, or pre-built releases above.

Attempting to build from source without authorised access may lead to unexpected consequences.

⁠CLI usage

# Analyse a file
anya --file suspicious.exe

# JSON output
anya --file suspicious.exe --json

# Batch scan
anya --directory ./samples --recursive --json --output results.jsonl --append

# Teacher Mode (guided lessons inline)
anya --file suspicious.exe --guided

# Random Bible verse
anya verse

# Init config
anya --init-config

# Verdict + explanations
anya --file suspicious.exe --explain

# Batch summary table
anya --directory ./samples --recursive --summary

# Check hash against known-bad list
anya hash-check suspicious.exe --against known-bad.txt

# Generate YARA rule from strings
anya yara from-strings strings.txt --output rule.yar

# Combine YARA rules
anya yara combine ./rules combined.yar --recursive

# Save to investigation case
anya --file suspicious.exe --case operation-nightfall

# List cases
anya cases --list

⁠Additional commands

# Watch a directory for new malware samples
anya watch ./incoming --recursive

# Compare two files side by side
anya compare sample_v1.exe sample_v2.exe

# Generate a standalone HTML report
anya --file suspicious.exe --format html --output report.html

# Generate shell completions
anya completions bash > ~/.bash_completion.d/anya

# Batch analysis with progress bar
anya --directory ./samples --recursive

Full flag reference: anya --help

⁠GUI

Launch Anya, drag a file onto the drop zone — or use the + button for single file or Batch Analysis (analyse a whole folder).

Batch Analysis — select a folder to scan all executables. Files appear in a collapsible sidebar with colour-coded verdicts. A summary dashboard shows verdict breakdown and a donut chart.

Teacher Mode (toggle in Settings → Learning) surfaces contextual lessons as you navigate. Click any DLL, security card, IOC block, or MITRE technique for beginner-friendly explanations with real-world examples.

Case management — Save to Case button in the TopBar, Case Browser on the DropZone for browsing and reopening past investigations.

Keyboard shortcuts — Ctrl+O to open a file, 1-7 to switch tabs, ? for a shortcuts overlay.

File comparison — side-by-side diff of two analyses highlighting verdict, entropy, import, and string differences.

Pin findings — pin important findings to the top of the Overview tab for quick reference.

Copy-friendly output — hover any hash, finding, or section to copy it to the clipboard.

Drag-and-drop tab reorder — reorder analysis tabs to match your workflow.

Export HTML report — generate a standalone HTML report with embedded CSS and SVG charts from the export dropdown.

Recent files appear on the drop zone for quick re-analysis. A guided tour walks first-time users through the interface.

Analysis history is stored in a local SQLite database. Nothing leaves your device.

⁠Why Anya?

⁠Docs

• Architecture⁠
• JSON output schema⁠
• CHANGELOG⁠
• Security scope & limitations⁠
• Privacy policy⁠
• Commercial licensing⁠

⁠Uninstalling

• Windows: Use Add/Remove Programs — the uninstaller launches automatically.
• Linux: sudo apt remove anya — the uninstaller runs during removal.
• macOS: Drag Anya.app to the Trash, then optionally run: ~/Applications/Anya.app/Contents/MacOS/anya-gui --uninstall to remove your analysis database and preferences.

⁠Licence

AGPL-3.0-or-later. See LICENSE.TXT⁠.

Commercial licensing: [email protected]⁠