<s> '''<STR_LIT>''' <EOL> import re <EOL> import inspect <EOL> import pefile <EOL> class PEIndicators ( object ) : <EOL> '''<STR_LIT>''' <EOL> dependencies = [ '<STR_LIT>' ] <EOL> def __init__ ( self ) : <EOL> '''<STR_LIT>''' <EOL> self . pefile_handle = None <EOL> def execute ( self , input_data ) : <EOL> '''<STR_LIT>''' <EOL> raw_bytes = input_data [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> try : <EOL> self . pefile_handle = pefile . PE ( data = raw_bytes , fast_load = False ) <EOL> except ( AttributeError , pefile . PEFormatError ) , error : <EOL> return { '<STR_LIT:error>' : str ( error ) , '<STR_LIT>' : [ { '<STR_LIT>' : '<STR_LIT>' } ] } <EOL> indicators = [ ] <EOL> indicators += [ { '<STR_LIT:description>' : warn , '<STR_LIT>' : <NUM_LIT:2> , '<STR_LIT>' : '<STR_LIT>' } <EOL> for warn in self . pefile_handle . get_warnings ( ) ] <EOL> check_methods = self . _get_check_methods ( ) <EOL> for check_method in check_methods : <EOL> hit_data = check_method ( ) <EOL> if hit_data : <EOL> indicators . append ( hit_data ) <EOL> return { '<STR_LIT>' : indicators } <EOL> def check_corrupted_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> pe_warning_matches = [ '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' ] <EOL> match_hits = self . _search_within_pe_warnings ( pe_warning_matches ) <EOL> if match_hits : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : match_hits } <EOL> else : <EOL> return None <EOL> def check_checksum_is_zero ( self ) : <EOL> '''<STR_LIT>''' <EOL> if self . pefile_handle . OPTIONAL_HEADER : <EOL> if not self . pefile_handle . OPTIONAL_HEADER . CheckSum : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:1> , '<STR_LIT>' : '<STR_LIT>' } <EOL> return None <EOL> def check_checksum_mismatch ( self ) : <EOL> '''<STR_LIT>''' <EOL> if self . pefile_handle . OPTIONAL_HEADER : <EOL> if self . pefile_handle . OPTIONAL_HEADER . CheckSum != self . pefile_handle . generate_checksum ( ) : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:2> , '<STR_LIT>' : '<STR_LIT>' } <EOL> return None <EOL> def check_empty_section_name ( self ) : <EOL> '''<STR_LIT>''' <EOL> for section in self . pefile_handle . sections : <EOL> if not section . Name : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' } <EOL> return None <EOL> def check_nonstandard_section_name ( self ) : <EOL> '''<STR_LIT>''' <EOL> std_sections = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> for i in range ( <NUM_LIT:200> ) : <EOL> std_sections . append ( '<STR_LIT:/>' + str ( i ) ) <EOL> non_std_sections = [ ] <EOL> for section in self . pefile_handle . sections : <EOL> name = convert_to_ascii_null_term ( section . Name ) . lower ( ) <EOL> if ( name not in std_sections ) : <EOL> non_std_sections . append ( name ) <EOL> if non_std_sections : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : non_std_sections } <EOL> return None <EOL> def check_image_size_incorrect ( self ) : <EOL> '''<STR_LIT>''' <EOL> last_virtual_address = <NUM_LIT:0> <EOL> last_virtual_size = <NUM_LIT:0> <EOL> section_alignment = self . pefile_handle . OPTIONAL_HEADER . SectionAlignment <EOL> total_image_size = self . pefile_handle . OPTIONAL_HEADER . SizeOfImage <EOL> for section in self . pefile_handle . sections : <EOL> if section . VirtualAddress > last_virtual_address : <EOL> last_virtual_address = section . VirtualAddress <EOL> last_virtual_size = section . Misc_VirtualSize <EOL> last_virtual_size += section_alignment - ( last_virtual_size % section_alignment ) <EOL> if ( last_virtual_address + last_virtual_size ) != total_image_size : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' } <EOL> return None <EOL> def check_overlapping_headers ( self ) : <EOL> '''<STR_LIT>''' <EOL> matches = [ '<STR_LIT>' ] <EOL> match_hits = self . _search_within_pe_warnings ( matches ) <EOL> if match_hits : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' } <EOL> def check_section_unaligned ( self ) : <EOL> '''<STR_LIT>''' <EOL> file_alignment = self . pefile_handle . OPTIONAL_HEADER . FileAlignment <EOL> unaligned_sections = [ ] <EOL> for section in self . pefile_handle . sections : <EOL> if section . PointerToRawData % file_alignment : <EOL> unaligned_sections . append ( section . Name ) <EOL> if unaligned_sections : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : unaligned_sections } <EOL> return None <EOL> def check_section_oversized ( self ) : <EOL> '''<STR_LIT>''' <EOL> total_image_size = self . pefile_handle . OPTIONAL_HEADER . SizeOfImage <EOL> for section in self . pefile_handle . sections : <EOL> if section . PointerToRawData + section . SizeOfRawData > total_image_size : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : section . Name } <EOL> return None <EOL> def check_dll_with_no_exports ( self ) : <EOL> '''<STR_LIT>''' <EOL> if self . pefile_handle . is_dll ( ) and not hasattr ( self . pefile_handle , '<STR_LIT>' ) : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' } <EOL> else : <EOL> return None <EOL> def check_communication_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:1> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_elevating_privs_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if ( matching_imports ) : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:2> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_keylogging_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' <EOL> '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:2> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_system_state_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:1> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_system_probe_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:2> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_system_integrity_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_crypto_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_anti_debug_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_com_service_imports ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_process_manipulation ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:3> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_process_spawn ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , <EOL> '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:2> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_stealth_load ( self ) : <EOL> '''<STR_LIT>''' <EOL> imports = [ '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' , '<STR_LIT>' ] <EOL> matching_imports = self . _search_for_import_symbols ( imports ) <EOL> if matching_imports : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , <EOL> '<STR_LIT>' : <NUM_LIT:2> , '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : matching_imports } <EOL> else : <EOL> return None <EOL> def check_invalid_entry_point ( self ) : <EOL> '''<STR_LIT>''' <EOL> matches = [ '<STR_LIT>' , <EOL> '<STR_LIT>' ] <EOL> match_hits = self . _search_within_pe_warnings ( matches ) <EOL> if match_hits : <EOL> return { '<STR_LIT:description>' : '<STR_LIT>' , '<STR_LIT>' : <NUM_LIT:3> , <EOL> '<STR_LIT>' : '<STR_LIT>' , '<STR_LIT>' : match_hits } <EOL> else : <EOL> return None <EOL> def check_exports ( self ) : <EOL> '''<STR_LIT>''' <EOL> exports = [ '<STR_LIT>' ] <EOL> self . _search_for_export_symbols ( exports ) <EOL> def _search_within_pe_warnings ( self , matches ) : <EOL> '''<STR_LIT>''' <EOL> pattern = '<STR_LIT:|>' . join ( re . escape ( match ) for match in matches ) <EOL> exp = re . compile ( pattern ) <EOL> if any ( exp . search ( warning ) for warning in self . pefile_handle . get_warnings ( ) ) : <EOL> return True <EOL> return False <EOL> def _search_for_import_symbols ( self , matches ) : <EOL> '''<STR_LIT>''' <EOL> if not hasattr ( self . pefile_handle , '<STR_LIT>' ) : <EOL> return [ ] <EOL> pattern = '<STR_LIT:|>' . join ( re . escape ( match ) for match in matches ) <EOL> exp = re . compile ( pattern ) <EOL> symbol_list = [ ] <EOL> for module in self . pefile_handle . DIRECTORY_ENTRY_IMPORT : <EOL> for symbol in module . imports : <EOL> if ( symbol . name ) : <EOL> symbol_list . append ( symbol . name . lower ( ) ) <EOL> symbol_matches = [ ] <EOL> for symbol in symbol_list : <EOL> if exp . search ( symbol ) : <EOL> symbol_matches . append ( symbol ) <EOL> return symbol_matches <EOL> def _search_for_export_symbols ( self , matches ) : <EOL> '''<STR_LIT>''' <EOL> pattern = '<STR_LIT:|>' . join ( re . escape ( match ) for match in matches ) <EOL> exp = re . compile ( pattern ) <EOL> symbol_list = [ ] <EOL> try : <EOL> for symbol in self . pefile_handle . DIRECTORY_ENTRY_EXPORT . symbols : <EOL> if symbol . name : <EOL> symbol_list . append ( symbol . name . lower ( ) ) <EOL> symbol_matches = [ ] <EOL> for symbol in symbol_list : <EOL> if exp . search ( symbol ) : <EOL> symbol_matches . append ( symbol ) <EOL> return symbol_matches <EOL> except AttributeError : <EOL> return [ ] <EOL> def _get_check_methods ( self ) : <EOL> results = [ ] <EOL> for key in dir ( self ) : <EOL> try : <EOL> value = getattr ( self , key ) <EOL> except AttributeError : <EOL> continue <EOL> if inspect . ismethod ( value ) and key . startswith ( '<STR_LIT>' ) : <EOL> results . append ( value ) <EOL> return results <EOL> def convert_to_ascii_null_term ( string ) : <EOL> '''<STR_LIT>''' <EOL> string = string . split ( '<STR_LIT:\x00>' , <NUM_LIT:1> ) [ <NUM_LIT:0> ] <EOL> return string . decode ( '<STR_LIT:ascii>' , '<STR_LIT:ignore>' ) <EOL> def test ( ) : <EOL> '''<STR_LIT>''' <EOL> import pprint <EOL> import zerorpc <EOL> workbench = zerorpc . Client ( timeout = <NUM_LIT> , heartbeat = <NUM_LIT> ) <EOL> workbench . connect ( "<STR_LIT>" ) <EOL> import os <EOL> data_path = os . path . join ( os . path . dirname ( os . path . realpath ( __file__ ) ) , <EOL> '<STR_LIT>' ) <EOL> md5_bad = workbench . store_sample ( open ( data_path , '<STR_LIT:rb>' ) . read ( ) , '<STR_LIT>' , '<STR_LIT>' ) <EOL> data_path = os . path . join ( os . path . dirname ( os . path . realpath ( __file__ ) ) , <EOL> '<STR_LIT>' ) <EOL> md5_good = workbench . store_sample ( open ( data_path , '<STR_LIT:rb>' ) . read ( ) , '<STR_LIT>' , '<STR_LIT>' ) <EOL> worker = PEIndicators ( ) <EOL> output = worker . execute ( workbench . get_sample ( md5_bad ) ) <EOL> print '<STR_LIT>' <EOL> pprint . pprint ( output ) <EOL> output = worker . execute ( workbench . get_sample ( md5_good ) ) <EOL> print '<STR_LIT>' <EOL> pprint . pprint ( output ) <EOL> output = workbench . work_request ( '<STR_LIT>' , md5_bad ) <EOL> print '<STR_LIT>' <EOL> pprint . pprint ( output ) <EOL> if __name__ == "<STR_LIT:__main__>" : <EOL> test ( ) </s>
