peframe.py

#!/usr/bin/env python

# PEframe
#
# PEframe is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# PEframe is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with PEframe. If not, see <http://www.gnu.org/licenses/>.

import os, sys
import time, datetime

sys.path.insert(0, 'modules')

try:
	import pecore
except ImportError:
	print '[!] pecore not found.'
	sys.exit(0)

# INFORMATION
NAME		= "peframe"
VERSION		= "1.0"
AUTHOR		= "Authors : Gianni Amato, Abdesslem Ask3m"
GITHUB		= "Github: https://github.com/abdesslem/malwareHunter"
INFO		= NAME+" v."+VERSION+" - Open Source Project\n"+AUTHOR+"\n"+GITHUB

def show_hash(filename):
	hashcode = pecore.get_hash(filename)
	md5      = hashcode[0]
	sha1     = hashcode[1]
	imph     = hashcode[2]
        file1 = open("/tmp/info.txt", "w")
        file1.write("Hash MD5".ljust(18)+ md5)
        file1.write("Hash SAH1".ljust(18)+ sha1)
        file1.write("Imphash".ljust(18)+ imph)
	file1.close()

def show_info(filename):
	info = pecore.get_info(filename)
	name = info[0]
	size = info[1]
	time = datetime.datetime.fromtimestamp(info[2])
	dll  = info[3]
	sect = info[4]
        file1 = open("/tmp/info.txt", "w")
        file1.write("File Name".ljust(18) + str(name))
        file1.write("File Size".ljust(18) + str(size) + "byte")
        file1.write("Compile Time".ljust(18) + str(time))
	if dll:
		file1.write("DLL".ljust(18)+ "Yes")
	else:
		file1.write("DLL".ljust(18)+ "No")
	file1.write("Sections".ljust(18)+ str(sect))
        file1.close()

def check_packer(filename):
	peid = pecore.check_peid(filename)
	if peid:
		print "Packer".ljust(18), "Yes"
	else:
		print "Packer".ljust(18), "No"

def show_packer(filename):
	peid = pecore.check_peid(filename)
	if peid != None:
		len_peid = len(peid)
                file2 = open("/tmp/packer.txt", "w")
                file2.write("\nPacker matched [" + str(len_peid) + "]")
		print "-"*60
                file2.write("-"*60)
		for i in range(0, len_peid):
			file2.write("Packer".ljust(18)+ peid[i][0])
                file2.close()
def check_antidbg(filename):
	antidbg = pecore.get_apiantidbg(filename)
	if antidbg:
		print "Anti Debug".ljust(18), "Yes"
		return True
	else:
		print "Anti Debug".ljust(18), "No"
		return False

def show_antidbg(filename):
	antidbg = pecore.get_apiantidbg(filename)
        file3 = open("/tmp/antiDebug.txt", "w")
	if antidbg:
		len_antidbg = len(antidbg)
                file3.write("\nAnti Debug discovered [" + str(len_antidbg) + "]")
		file3.write("-"*60)
       
		for i in range(0, len_antidbg):
			file3.write("Anti Debug".ljust(18)+antidbg[i])
                file3.close()

def check_antivm(filename):
	antivm = pecore.check_antivm(filename)
	if antivm:
		print 'Anti VM'.ljust(18), "Yes"
	else:
		print 'Anti VM'.ljust(18), "No"

def show_antivm(filename):
	antivm = pecore.check_antivm(filename)
        file4 = open("/tmp/antiVm.txt", "w")
	if antivm:
		len_antivm = len(antivm)
                
		file4.write("\nAnti VM Trick discovered [" + str(len_antivm) + "]")
		file4.write("-"*60)
		for i in range(0, len_antivm):
			file4.write('Trick'.ljust(18)+ antivm[i])
                file4.close()
def show_suspicious(filename):
	apialert = pecore.get_apialert(filename)
        file5 = open("/tmp/susApi.txt", "w")
	if apialert:
		len_apialert = len(apialert)
                
                
		file5.write("\nSuspicious API discovered [" + str(len_apialert) + "]")
		file5.write("-"*60)
		for i in range(0, len_apialert):
			file5.write('Function'.ljust(18) + apialert[i])
                file5.close()
def show_secsuspicious(filename):
	secsuspicious = pecore.get_sectionsalert(filename)
        file6 = open("/tmp/susSec.txt", "w")
	if secsuspicious:
		len_secsuspicious = len(secsuspicious)
                
		file6.write("\nSuspicious Sections discovered [" + str(len_secsuspicious) + "]")
		file6.write("-"*60)
		for i in range(0, len_secsuspicious):
			file6.write('Section'.ljust(18)+secsuspicious[i][0])
			file6.write('Hash MD5'.ljust(18)+secsuspicious[i][1])
			file6.write('Hash SHA-1'.ljust(18)+secsuspicious[i][2])
                file6.close()
			
def show_fileurl(filename):
	getfileurl = pecore.get_fileurl(filename)
        file7 = open("/tmp/file.txt", "w")
	if getfileurl:
		len_url  = len(getfileurl[0])
		len_file = len(getfileurl[1])
                
		if len_file > 0:
  
			file7.write("\nFile name discovered [" + str(len_file) + "]")
			file7.write("-"*60)
			for i in range(0, len_file):
				file7.write(getfileurl[1][i][0].ljust(18)+ getfileurl[1][i][1])
		if len_url > 0:
			file7.write("\nUrl discovered [" + str(len_url) + "]")
			file7.write("-"*60)
			for i in range(0, len_url):
				file7.write('Url'.ljust(18)+ getfileurl[0][i])
        file7.close()
				
def show_meta(filename):
	spl = []
	meta = pecore.get_meta(filename)
	if meta:
		len_meta = len(meta)
		print "\nMeta data found [" + str(len_meta) + "]"
		print "-"*60
		for i in range(0, len_meta):
			spl.append(meta[i].split(':'))
		for i in range(0, len_meta):
			print str(spl[i][0]).ljust(18), str(spl[i][1])
				
def show_sections(filename):
	sections = pecore.get_sections(filename)
	if sections:
		len_sections = len(sections)
		print "\nSections discovered [" + str(len_sections) + "]"
		print "-"*60
		for i in range(0, len_sections):
			print '\nSection'.ljust(18), sections[i][0]
			print 'Hash MD5'.ljust(18), sections[i][1]
			print 'Hash SHA-1'.ljust(18), sections[i][2]		
			print 'VirtualAddress'.ljust(18), sections[i][4]
			print 'VirtualSize'.ljust(18), sections[i][5]
			print 'SizeofRawData'.ljust(18), sections[i][6]
			suspicious = sections[i][3]
			if suspicious:
				print 'Suspicious'.ljust(18), "Yes"
			else:
				print 'Suspicious'.ljust(18), "No"

def show_imported_functions(filename):
	imported = pecore.get_imported_functions(filename)
	arrayDll = []
	if imported:
		len_imported = len(imported)
		for i in range(0, len_imported):
			arrayDll.append(imported[i][0])
		dllfound = set(arrayDll)
		print "\nImported [" + str(len(dllfound)) +"] DLL and [" + str(len_imported) + "] Functions"
		print "-"*60
		for i in range(0, len_imported):
			dll      = imported[i][0]
			address  = imported[i][1]
			function = imported[i][2]
			print dll.ljust(18),address,function

def show_exported_functions(filename):
	exported = pecore.get_exported_functions(filename)
	arrayDll = []
#	print exported
	if exported:
		len_imported = len(exported)
		for i in range(0, len_exported):
			arrayDll.append(exported[i][0])
		dllfound = set(arrayDll)
		print "\nExported [" + str(len(dllfound)) +"] DLL and [" + str(len_exported) + "] Functions"
		print "-"*60
		for i in range(0, len_exported):
			dll      = exported[i][0]
			address  = exported[i][1]
			function = exported[i][2]
			print dll.ljust(18),address,function

def show_directory(filename):
	imports    = pecore.get_import(filename)
	exports    = pecore.get_export(filename)
	resources  = pecore.get_resource(filename)
	debugs     = pecore.get_debug(filename)
	tls        = pecore.get_tls(filename)
	relocation = pecore.get_basereloc(filename)

	dirlist   = []
	
	if imports:
		dirlist.append("Import")
	if exports:
		dirlist.append("Export")
	if resources:
		dirlist.append("Resource")
	if debugs:
		dirlist.append("Debug")
	if tls:
		dirlist.append("TLS")
	if relocation:
		dirlist.append("Relocation")

	print "Directory".ljust(18), ", ".join(dirlist)
			

def show_dump(filename):
	dump = pecore.get_dump(filename)
	print dump

def show_resource_dump(filename, directory):
	if directory == "import":
		imports = pecore.get_import(filename)
		if imports:
			print "\nDirectory dump for " + directory.upper() + " raw data"
			print "-"*60
			print imports
	if directory == "export":
		exports = pecore.get_export(filename)
		print "\nDirectory dump for " + directory.upper() + " raw data"
		print "-"*60
		print exports
	if directory == "resource":
		resources = pecore.get_resource(filename)
		if resources:
			print "\nDirectory dump for " + directory.upper() + " raw data"
			print "-"*60
			print resources
	if directory == "debug":
		debugs = pecore.get_debug(filename)
		if debugs:
			print "\nDirectory dump for " + directory.upper() + " raw data"
			print "-"*60
			print debugs
	if directory == "tls":
		tlss = pecore.get_tls(filename)
		if tlss:
			print "\nDirectory dump for " + directory.upper() + " raw data"
			print "-"*60
			print tlss
	if directory == "relocation":
		relocations = pecore.get_basereloc(filename)
		if relocations:
			print "\nDirectory dump for " + directory.upper() + " raw data"
			print "-"*60
			print relocations

def show_strings(filename):
	strings = pecore.get_strings(filename)
	if(strings):
		for string in strings:
			print string

def check_isfile(filename):
	isfile = os.path.isfile(filename)
	if not isfile:
		print "File not found:", filename
		sys.exit(0)
	ispe = pecore.is_pe(filename)
	if not ispe:
		print "No PE file:", filename
		sys.exit(0)	

def autoanalysis(filename):
	print "\nShort information"
	print "-"*60
	show_info(filename)
	show_hash(filename)
	check_packer(filename)
	check_antidbg(filename)
	check_antivm(filename)
	show_directory(filename)

	show_packer(filename)
	show_antidbg(filename)
	show_antivm(filename)
	show_suspicious(filename)
	show_secsuspicious(filename)
	show_fileurl(filename)
	show_meta(filename)

	show_sections(filename)
	show_imported_functions(filename)
	show_exported_functions(filename)
	show_dump(filename)
	show_strings(filename)
	show_resource_dump(filename, "resource")