def get_sections(self, machos, fbuffer) -> list: ''' get sections ''' _list = [] for h in machos.headers: for lc, cmd, data in h.commands: if hasattr(cmd, "segname"): #fbuffer[cmd.fileoff:cmd.filesize] with BytesIO(fbuffer) as bio: bio.seek(cmd.fileoff) x = bio.read(cmd.filesize) sus = "No" entropy = get_entropy_float_ret(x) if entropy > 6 or entropy >= 0 and entropy <= 1: sus = "True, {}".format(entropy) elif cmd.filesize == 0: sus = "True, section size 0" seg = cmd.segname[:cmd.segname.find(b'\x00')].decode( "utf-8", errors="ignore") if seg == "__PAGEZERO": sus = "" _list.append({ "Section": seg, "Suspicious": sus, "Size": cmd.filesize, "Entropy": get_entropy(x), "MD5": md5(x).hexdigest(), "Description": "" }) return _list
def get_sections(self, pe_info) -> list: ''' get sections ''' temp_list = [] for section in pe_info.sections: is_sus = "No" entropy = get_entropy_float_ret(section.get_data()) if entropy > 6 or (0 <= entropy <= 1): is_sus = "True, {}".format(entropy) elif section.SizeOfRawData == 0: is_sus = "True, section size 0" temp_list.append({ "Section": section.Name.decode("utf-8", errors="ignore").strip("\00"), "Suspicious": is_sus, "Size": section.SizeOfRawData, "MD5": section.get_hash_md5(), "Entropy": get_entropy(section.get_data()), "Description": "" }) return temp_list
def check_entropy(self, data, domains): ''' loop sequences, get entropy ''' for domain in domains: domain = domain["domain"] entropy = get_entropy_float_ret(domain) if entropy > 3.7: data.append({ "Entropy": "{0:.15f}".format(entropy), "URL": domain })
def get_section(self, elf) -> list: ''' get all sections of elf ''' temp_list = [] for section in elf.iter_sections(): if section.name != "": sus = "No" entropy = get_entropy_float_ret(section.data()) if entropy > 6 or (0 <= entropy <= 1): sus = "True, {}".format(entropy) elif section.data_size == 0: sus = "True, section size 0" temp_list.append({"Section":section.name, "Suspicious":sus, "Size":section.data_size, "MD5":md5(section.data()).hexdigest(), "Entropy":get_entropy(section.data()), "Description":""}) return temp_list