'''
Malware analysis helper v1
Licenta de utilizare:
1. acest script poate fi folosit in mod gratuit de orice persoana strict in scop personal (NO money involved)
2. utilizarea acestui script se face pe propria raspundere, nu se acorda nici un fel de garantie
Utilizare:
python numescript.py nume_fisier_executabil.exe
Python 2.7
'''
import sys
import win32api
import hashlib
import os
numef = sys.argv[1]
numeoutf = numef + ".txt"
outf = open(numeoutf, "a")
txteditor = '"c:\\Program Files\\Notepad++\\Notepad++.exe"'
deschidtxt = txteditor +" "+ numeoutf
def md5Checksum(filePath):
fh = open(filePath, 'rb')
m = hashlib.md5()
while True:
data = fh.read(8192)
if not data:
break
m.update(data)
return m.hexdigest()
#==============================================================================
def getFileProperties(fname):
#==============================================================================
"""
all credits for funtion getFileProperties go to: http://stackoverflow.com/a/7993095
Read all properties of the given file return them as a dictionary.
"""
propNames = ('Comments', 'InternalName', 'ProductName', 'CompanyName', 'LegalCopyright', 'ProductVersion', 'FileDescription', 'LegalTrademarks', 'PrivateBuild', 'FileVersion', 'OriginalFilename', 'SpecialBuild')
props = {'FixedFileInfo': None, 'StringFileInfo': None, 'FileVersion': None}
try:
# backslash as parm returns dictionary of numeric info corresponding to VS_FIXEDFILEINFO struc
fixedInfo = win32api.GetFileVersionInfo(fname, '\\')
props['FixedFileInfo'] = fixedInfo
props['FileVersion'] = "%d.%d.%d.%d" % (fixedInfo['FileVersionMS'] / 65536,
fixedInfo['FileVersionMS'] % 65536, fixedInfo['FileVersionLS'] / 65536,
fixedInfo['FileVersionLS'] % 65536)
# \VarFileInfo\Translation returns list of available (language, codepage)
# pairs that can be used to retreive string info. We are using only the first pair.
lang, codepage = win32api.GetFileVersionInfo(fname, '\\VarFileInfo\\Translation')[0]
# any other must be of the form \StringfileInfo\%04X%04X\parm_name, middle
# two are language/codepage pair returned from above
strInfo = {}
for propName in propNames:
strInfoPath = u'\\StringFileInfo\\%04X%04X\\%s' % (lang, codepage, propName)
## print str_info
strInfo[propName] = win32api.GetFileVersionInfo(fname, strInfoPath)
props['StringFileInfo'] = strInfo
except:
pass
return props
md5 = md5Checksum(numef)
print >>outf, "Name:", numef
print >>outf, "Size:", os.path.getsize(numef)
print >>outf, "Md5 hash:", md5, "\n"
version = getFileProperties(numef)
for a in version.keys():
if type(version[a]) == type(dict()):
#print "este un dictionar"
dict1 = version[a]
for b in dict1.keys():
try:
#print "sunt in try:"
if dict1[b] != "None":
print >>outf, b + ": " + dict1[b]
except:
#print "sunt in except:"
pass
else:
print>>outf, a, ":", version[a]
print >>outf, " "
print >>outf, "<strong>antivirus detection:</strong>","\n"
print >>outf, "<strong>process:</strong>","\n"
print >>outf, "<strong>network activity:</strong>","\n"
print >>outf, "<strong>persistence:</strong>","\n"
print >>outf, "<strong>new files:</strong>","\n"
print >>outf, "<strong>registry:</strong>","\n"
print >>outf, "<strong>memory strings:</strong>","\n"
print >>outf, "<strong>malware type:</strong>","\n"
print >>outf, "<strong>removal:</strong>","\n"
print >>outf, "<strong></strong>","\n",
outf.close()
os.system(deschidtxt)
Exemplu output: 2013 HACK UPDATE V4.2.ex.txt
Name: 2013 HACK UPDATE V4.2.ex
Size: 397312
Md5 hash: e78198b08ce510e27183fee01886125f
FileVersion : 0.4.0.0
InternalName: 11
FileVersion: 0.04
CompanyName: SIMPLY THE WORST
ProductName: msi
ProductVersion: 0.04
OriginalFilename: 11.exe
antivirus detection:
process:
network activity:
persistence:
new files:
registry:
memory strings:
malware type:
removal:
