Merge pull request #44 from Bor-Code/docs/document-static-risk-score

docs: document static risk score

Author: Bor-Code

README.md

@@ -32,6 +32,27 @@ The project currently operates through a command-line interface. Static analysis
 * Static analysis TXT report output
 * Static analysis JSON report output
 
+### Static Risk Score
+
+Static analysis calculates an overall risk score by combining suspicious API severity levels and section entropy risk levels.
+
+The score is heuristic and does not prove that a file is malicious. It is used to prioritize files that may need deeper manual review.
+
+Risk levels:
+
+| Score Range | Risk Level |
+| ----------- | ---------- |
+| 0 - 19      | Low        |
+| 20 - 49     | Medium     |
+| 50 - 100    | High       |
+
+TXT reports include:
+
+```text
+Overall Risk
+Risk Score: 39
+Risk Level: Medium
+
 ### Experimental Dynamic Analysis
 
 * Starts the target executable with the Windows Debugging API