Windows Malware Detection Dataset

A dataset for Windows Portable Executable Samples with four feature sets. It contains four CSV files, one CSV file per feature set. 1. First feature set (DLLs_Imported.csv file) contains the DLLs imported by each malware family. The first column contains SHA256 values, second column contains the label or family type of the malware while the remaining columns list the names of imported DLLs. 2. Second feature set (API_Functions.csv files) contains the API functions called by these malware alongwith their SHA256 hash values and labels. 3. Third feature set (PE_Header.csv) contains values of 52 fields of PE header. All the fields are labelled in the CSV file. 4. Fourth feature set (PE_Section.csv file) contains 9 field values of 10 different PE sections. All the fields are labelled in the CSV file. <br> Malware Type / family Labels: 0=Benign 1=RedLineStealer 2= Downloader 3=RAT 4=BankingTrojan 5=SnakeKeyLogger 6=Spyware <br>

本数据集面向Windows可移植可执行文件（Portable Executable，PE）样本，共包含四类特征集。数据集共包含四个CSV文件，每类特征集对应一个CSV文件。
1. 第一类特征集（DLLs_Imported.csv）收录各恶意软件家族导入的动态链接库（Dynamic Link Library，DLL）。该CSV文件首列为SHA256哈希值，第二列为恶意软件的标签或家族类型，其余列依次列出所导入的动态链接库名称。
2. 第二类特征集（API_Functions.csv）收录这些恶意软件调用的应用程序编程接口（Application Programming Interface，API）函数，同时附带对应的SHA256哈希值与标签。
3. 第三类特征集（PE_Header.csv）收录PE头部52个字段的取值，所有字段均在CSV文件中配有明确标签。
4. 第四类特征集（PE_Section.csv）收录10个不同PE节区的9个字段取值，所有字段均在CSV文件中配有明确标签。
恶意软件类型/家族标签对应关系如下：0=良性样本 1=RedLineStealer 2=下载器 3=远程访问木马（Remote Access Trojan，RAT） 4=银行木马 5=SnakeKeyLogger 6=间谍软件