Skip to main content
journal@msti-indonesia.com 081377790601
Register
Articles

Simple Antivirus Scanner: A Signature-Based Malware Detection System Using Delphi

  • 1* SourceCodester Community

* Corresponding Author: Antonov Alin

Open Access
DOI
https://doi.org/10.59431/jda.v4i2.665
Published
Pages
68-76

Issue

Vol. 4 No. 2 (2025)

Journal Dekstop Application (JDA)
December

Abstract

The Simple Antivirus Scanner was developed as an instructional model to demonstrate the core mechanisms of signature-based malware detection. Implemented using Delphi, the system integrates MD5 hashing, database-driven signature comparison, and asynchronous scanning through the TBackgroundWorker component, providing both functionality and responsiveness in a Windows environment. The project’s architecture includes recursive file traversal, efficient hash computation, and a structured virus definition database that enables accurate identification of known malware. The inclusion of a harmless test virus allows for safe experimentation and validation of the detection process, reinforcing user understanding of hash-based recognition. Results show that the system performs effectively in detecting catalogued threats, offering a predictable and transparent learning experience. However, it lacks the capabilities of modern antivirus systems such as heuristic analysis, real-time protection, and automated signature updates. As a pedagogical platform, it serves as a bridge between theory and practice—illustrating file system operations, cryptographic applications, and data-driven threat identification. Future development may expand the scanner into a more comprehensive framework incorporating multi-layered detection, cloud-based updates, and AI-based classification. Ultimately, the project emphasizes clarity and accessibility, making it a valuable resource for students, educators, and cybersecurity enthusiasts seeking practical insight into antivirus design principles and malware detection logic.

Keywords

Antivirus Malware Detection Md5 Hashing Delphi Programming Cyber Security Education

How to Cite

Alin, A. (2025). Simple Antivirus Scanner: A Signature-Based Malware Detection System Using Delphi. Journal Dekstop Application (JDA), 4(2), 68-76. https://doi.org/10.59431/jda.v4i2.665

References

  • Ali, A., & Farhan, A. (2020). A novel improvement with an effective expansion to enhance the MD5 hash function for verification of a secure e-document. IEEE Access, 8, 80290–80304. https://doi.org/10.1109/ACCESS.2020.2989050.
  • Aycock, J. (2006). Computer viruses and malware. Springer.
  • Boyanov, P. (2024). Practical applications of hash functions MD5, SHA-1, and SHA-256 using various software tools to verify the integrity of files. Journal Scientific and Applied Research, 27(1), 120–137. https://doi.org/10.46687/jsar.v27i1.413.
  • Bonfante, G., Kaczmarek, M., & Marion, J. (2008). Architecture of a morphological malware detector. Journal in Computer Virology, 5(3), 263–270. https://doi.org/10.1007/s11416-008-0102-4.
  • Darem, A., Ghaleb, F., Alhashmi, A., Abawajy, J., Alanazi, S., & Al-Rezami, A. (2021). An adaptive behavioral-based incremental batch learning malware variants detection model using concept drift detection and sequential deep learning. IEEE Access, 9, 97180–97196. https://doi.org/10.1109/ACCESS.2021.3093366
  • Du, D., Sun, Y., Ma, Y., & Xiao, F. (2019). A novel approach to detect malware variants based on classified behaviors. IEEE Access, 7, 81770–81782. https://doi.org/10.1109/ACCESS.2019.2924331
  • Delphi documentation. Embarcadero Technologies. (n.d.). Delphi documentation. https://docwiki.embarcadero.com/
  • Gandotra, E., Bansal, D., & Sofat, S. (2014). Malware analysis and classification: A survey. Journal of Information Security, 5(2), 56–64. https://doi.org/10.4236/jis.2014.52006
  • Gaudesi, M., Marcelli, A., Sánchez, E., Squillero, G., & Tonda, A. (2015). Malware obfuscation through evolutionary packers (pp. 757–758). https://doi.org/10.1145/2739482.2764940
  • Kessler, G. (2016). The impact of MD5 file hash collisions on digital forensic imaging. The Journal of Digital Forensics, Security and Law. https://doi.org/10.15394/JDFSL.2016.1431
  • Kim, T., Kang, B., & Im, E. (2018). Runtime detection framework for Android malware. Mobile Information Systems, 2018, Article 8094314. https://doi.org/10.1155/2018/8094314
  • Mat, S., Razak, M., Kahar, M., Arif, J., Asmara, S., & Firdaus, A. (2021). Towards a systematic description of the field using bibliometric analysis: Malware evolution. Scientometrics, 126(3), 2013–2055. https://doi.org/10.1007/s11192-020-03834-6
  • Nkouankou, A., Clarice, F., Abel, W., & Ndoundam, R. (2022). Pre-image attack of the MD5 hash function by proportional logic. International Journal of Research and Innovation in Applied Science, 7(8), 20–25. https://doi.org/10.51584/ijrias.2022.7802
  • Oliver, J., Cheng, C., & Chen, Y. (2013). TLSH — a locality sensitive hash (pp. 7–13). https://doi.org/10.1109/CTC.2013.9
  • Rivest, R. (1992). RFC 1321: The MD5 message-digest algorithm. Internet Engineering Task Force. https://www.ietf.org/rfc/rfc1321.txt
  • Santos, I., Brezo, F., Sanz, B., Laorden, C., & Bringas, P. (2011). Using opcode sequences in single-class learning to detect unknown malware. IET Information Security, 5(4), 220–227. https://doi.org/10.1049/iet-ifs.2010.0180
  • Sikorski, M., & Honig, A. (2012). Practical malware analysis: The hands-on guide to dissecting malicious software (1st ed.). No Starch Press.
  • Souri, A., & Hosseini, R. (2018). A state-of-the-art survey of malware detection approaches using data mining techniques. Human-Centric Computing and Information Sciences, 8(1). https://doi.org/10.1186/s13673-018-0125-x
  • Signature-based detection in antivirus software. (2015). Journal of Computer Security. (Note: author(s), volume, and page numbers not provided in original list.).
  • Surendran, R., & Thomas, T. (2022). Detection of malware applications from centrality measures of syscall graph. Concurrency and Computation: Practice and Experience, 34(10). https://doi.org/10.1002/cpe.6835
  • TBackgroundWorker component documentation. (n.d.). DelphiArea. http://www.delphiarea.com/
  • Wagener, G., State, R., & Dulaunoy, A. (2007). Malware behaviour analysis. Journal in Computer Virology, 4(4), 279–287. https://doi.org/10.1007/s11416-007-0074-9
  • Wang, L., Ohta, K., Sasaki, Y., Sakiyama, K., & Kunihiro, N. (2010). Cryptanalysis of two MD5-based authentication protocols: APOP and NMAC. IEICE Transactions on Information and Systems, E93-D(5), 1087–1095. https://doi.org/10.1587/transinf.e93.d.1087
  • Wang, X., & Yu, H. (2005). How to break MD5 and other hash functions (pp. 19–35). https://doi.org/10.1007/11426639_2
  • Yerima, S., Sezer, S., & Muttik, I. (2015). High accuracy Android malware detection using ensemble learning. IET Information Security, 9(6), 313–320. https://doi.org/10.1049/iet-ifs.2014.0099

Author Biographies

  • Antonov Alin, SourceCodester Community

    SourceCodester Community, Romania.

License

Copyright (c) 2025 Journal Dekstop Application (JDA)

This is an open-access journal. All articles are distributed under the terms of the Creative Commons Attribution 4.0 International License (CC BY 4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Under this license, you are free to:

  • Share: Copy and redistribute the material in any medium or format.
  • Adapt: Remix, transform, and build upon the material for any purpose, even commercially.

Attribution Requirements:
You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.

Copyright and Retention:
Authors retain copyright without restrictions and grant this journal the right of first publication under an open-access model. The journal retains non-exclusive publishing rights for archiving, indexing, and scholarly dissemination.

Usage Statistics