1
2
3
4
5
7 com_exports = [
8 "DllInstall",
9 "DllCanUnloadNow",
10 "DllGetClassObject",
11 "DllRegisterServer",
12 "DllUnregisterServer",
13 ]
14
15 for name in com_exports:
16 if name not in exports:
17 return False
18 return True
19
21 """Choose analysis package due to file type and file extension.
22 @param file_type: file type.
23 @param file_name: file name.
24 @return: package name or None.
25 """
26 if not file_type:
27 return None
28
29 file_name = file_name.lower()
30
31 if "DLL" in file_type:
32 if file_name.endswith(".cpl"):
33 return "cpl"
34 elif has_com_exports(exports):
35 return "com"
36 else:
37 return "dll"
38 elif "PE32" in file_type or "MS-DOS" in file_type:
39 return "exe"
40 elif "PDF" in file_type or file_name.endswith(".pdf"):
41 return "pdf"
42 elif file_name.endswith(".pub"):
43 return "pub"
44 elif "Rich Text Format" in file_type or \
45 "Microsoft Word" in file_type or \
46 "Microsoft Office Word" in file_type or \
47 file_name.endswith((".doc", ".docx", ".rtf", ".docm")):
48 return "doc"
49 elif "Microsoft Office Excel" in file_type or \
50 "Microsoft Excel" in file_type or \
51 file_name.endswith((".xls", ".xlsx")):
52 return "xls"
53 elif "Microsoft PowerPoint" in file_type or \
54 file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")):
55 return "ppt"
56 elif file_name.endswith(".jar"):
57 return "jar"
58 elif "Zip" in file_type:
59 return "zip"
60 elif file_name.endswith((".py", ".pyc")) or "Python script" in file_type:
61 return "python"
62 elif file_name.endswith(".vbs"):
63 return "vbs"
64 elif file_name.endswith((".js", ".jse")):
65 return "js"
66 elif file_name.endswith(".msi"):
67 return "msi"
68 elif file_name.endswith(".ps1"):
69 return "ps1"
70 elif file_name.endswith(".wsf"):
71 return "wsf"
72 elif "HTML" in file_type or file_name.endswith((".htm", ".html", ".hta")):
73 return "ie"
74 else:
75 return "generic"
76