Package lib :: Package core :: Module packages
[hide private]
[frames] | no frames]

Source Code for Module lib.core.packages

 1  # Copyright (C) 2010-2013 Claudio Guarnieri. 
 2  # Copyright (C) 2014-2016 Cuckoo Foundation. 
 3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 4  # See the file 'docs/LICENSE' for copying permission. 
 5   
6 -def has_com_exports(exports):
7 com_exports = [ 8 "DllInstall", 9 "DllCanUnloadNow", 10 "DllGetClassObject", 11 "DllRegisterServer", 12 "DllUnregisterServer", 13 ] 14 15 for name in com_exports: 16 if name not in exports: 17 return False 18 return True
19
20 -def choose_package(file_type, file_name, exports):
21 """Choose analysis package due to file type and file extension. 22 @param file_type: file type. 23 @param file_name: file name. 24 @return: package name or None. 25 """ 26 if not file_type: 27 return None 28 29 file_name = file_name.lower() 30 31 if "DLL" in file_type: 32 if file_name.endswith(".cpl"): 33 return "cpl" 34 elif has_com_exports(exports): 35 return "com" 36 else: 37 return "dll" 38 elif "PE32" in file_type or "MS-DOS" in file_type: 39 return "exe" 40 elif "PDF" in file_type or file_name.endswith(".pdf"): 41 return "pdf" 42 elif file_name.endswith(".pub"): 43 return "pub" 44 elif "Rich Text Format" in file_type or \ 45 "Microsoft Word" in file_type or \ 46 "Microsoft Office Word" in file_type or \ 47 file_name.endswith((".doc", ".docx", ".rtf", ".docm")): 48 return "doc" 49 elif "Microsoft Office Excel" in file_type or \ 50 "Microsoft Excel" in file_type or \ 51 file_name.endswith((".xls", ".xlsx")): 52 return "xls" 53 elif "Microsoft PowerPoint" in file_type or \ 54 file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")): 55 return "ppt" 56 elif file_name.endswith(".jar"): 57 return "jar" 58 elif "Zip" in file_type: 59 return "zip" 60 elif file_name.endswith((".py", ".pyc")) or "Python script" in file_type: 61 return "python" 62 elif file_name.endswith(".vbs"): 63 return "vbs" 64 elif file_name.endswith((".js", ".jse")): 65 return "js" 66 elif file_name.endswith(".msi"): 67 return "msi" 68 elif file_name.endswith(".ps1"): 69 return "ps1" 70 elif file_name.endswith(".wsf"): 71 return "wsf" 72 elif "HTML" in file_type or file_name.endswith((".htm", ".html", ".hta")): 73 return "ie" 74 else: 75 return "generic"
76