100 lines
2.9 KiB
Python
100 lines
2.9 KiB
Python
|
import os
|
|||
|
|
import pefile
|
|||
|
|
import shutil
|
|||
|
|
from tqdm import tqdm
|
|||
|
|
def is_ELF_file(file_path):
|
|||
|
|
"""
|
|||
|
|
判断样本是否是ELF文件
|
|||
|
|
:param file_path:样本文件路径
|
|||
|
|
:return:是ELF文件返回True，否则返回False
|
|||
|
|
"""
|
|||
|
|
# 定义ELF文件的魔数
|
|||
|
|
ELF_MAGIC_NUMBER = b'\x7fELF'
|
|||
|
|
|
|||
|
|
# 读取文件前几个字节
|
|||
|
|
with open(file_path, 'rb') as f:
|
|||
|
|
header = f.read(4)
|
|||
|
|
|
|||
|
|
# 判断文件是否为ELF文件
|
|||
|
|
if header == ELF_MAGIC_NUMBER:
|
|||
|
|
return True
|
|||
|
|
else:
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
|
|||
|
|
def is_pe_file(file_path):
|
|||
|
|
"""
|
|||
|
|
判断样本是否是PE文件
|
|||
|
|
:param file_path:样本文件路径
|
|||
|
|
:return:是PE文件返回True，否则返回False
|
|||
|
|
"""
|
|||
|
|
try:
|
|||
|
|
with open(file_path, 'rb') as f:
|
|||
|
|
header = f.read(4)
|
|||
|
|
pe = pefile.PE(file_path)
|
|||
|
|
return True
|
|||
|
|
except pefile.PEFormatError:
|
|||
|
|
return False
|
|||
|
|
def importKnownPackers(filePath):
|
|||
|
|
knownPackers =[]
|
|||
|
|
try:
|
|||
|
|
with open(filePath) as packerPath:
|
|||
|
|
for line in packerPath:
|
|||
|
|
knownPackers.append(line.strip())
|
|||
|
|
except:
|
|||
|
|
print("Error reading given file.")
|
|||
|
|
return None
|
|||
|
|
|
|||
|
|
return knownPackers
|
|||
|
|
|
|||
|
|
|
|||
|
|
def detectPackers(pe, knownPackers):
|
|||
|
|
sections=[]
|
|||
|
|
for section in pe.sections:
|
|||
|
|
sections.append(section.Name.decode('utf-8').strip('\x00'))
|
|||
|
|
matches=[]
|
|||
|
|
|
|||
|
|
for section in sections:
|
|||
|
|
for item_section in knownPackers:
|
|||
|
|
if section == item_section or item_section==item_section.swapcase():
|
|||
|
|
matches.append(section)
|
|||
|
|
|
|||
|
|
return matches
|
|||
|
|
|
|||
|
|
|
|||
|
|
def detect_pack_res(targetMalware):
|
|||
|
|
knownPackerFile = "knownPackerSections.txt"
|
|||
|
|
targetMalware = pefile.PE(targetMalware)
|
|||
|
|
knownPackers = importKnownPackers(knownPackerFile)
|
|||
|
|
detectedPackers = detectPackers(targetMalware, knownPackers)
|
|||
|
|
targetMalware.close()
|
|||
|
|
if detectedPackers:
|
|||
|
|
print("有加壳")
|
|||
|
|
return True
|
|||
|
|
else:
|
|||
|
|
print("无加壳")
|
|||
|
|
return False
|
|||
|
|
|
|||
|
|
|
|||
|
|
class de_shell(object):
|
|||
|
|
def __init__(self,sample_path,save_dir):
|
|||
|
|
self.sample_path=sample_path
|
|||
|
|
self.save_dir=save_dir
|
|||
|
|
|
|||
|
|
def fileFilter(self):
|
|||
|
|
for root, dirs, files in os.walk(self.sample_path):
|
|||
|
|
for file in tqdm(files):
|
|||
|
|
# 获取文件所属目录
|
|||
|
|
# 获取文件路径
|
|||
|
|
# 删除指定后缀名的文件
|
|||
|
|
targetMalwarepath = os.path.join(root, file)
|
|||
|
|
print(targetMalwarepath)
|
|||
|
|
try:
|
|||
|
|
if detect_pack_res(targetMalwarepath):
|
|||
|
|
shutil.copy(targetMalwarepath, self.save_dir)
|
|||
|
|
os.remove(targetMalwarepath)
|
|||
|
|
print('删除加壳文件' + file+'已保存在'+self.save_dir+'中，请查看')
|
|||
|
|
except Exception as e:
|
|||
|
|
print(f"删除文件 {targetMalwarepath} 失败：{str(e)}")
|
|||
|
|
print("已留下清理后的样本文件")
|