Add files via upload
This commit is contained in:
2 files changed
+254
-14
No files matched your search
@@ -4,6 +4,7 @@ import xml.etree.ElementTree as xmlet
|
||||
import requests, pyperclip, win32file
|
||||
import win32gui, win32api, win32con
|
||||
from PYAS_Engine import ListSimHash
|
||||
from PYAS_Rules import pyasrule_dict
|
||||
from PYAS_Extension import slist, alist
|
||||
from PYAS_Language import translate_dict
|
||||
from PYAS_Interface import Ui_MainWindow
|
||||
@@ -841,21 +842,25 @@ class MainWindow_Controller(QMainWindow):
|
||||
try:
|
||||
label, level = self.api_scan(file)
|
||||
if file != self.pyas and level > 50:
|
||||
return f"{label}"
|
||||
return f"{label}/Cloud.{level}"
|
||||
elif file != self.pyas and level > 10:
|
||||
label_2, level_2 = self.pe_scan(file)
|
||||
#print(label_2, level_2, file)
|
||||
if "White" not in label_2 and "Unknown" not in label_2:
|
||||
return f"{label_2}"
|
||||
elif "Unknown" in label_2 and self.json["high_sensitive"]:
|
||||
return f"{label_2}"
|
||||
label_2, level_2 = self.rule_scan(file)
|
||||
if label_2 and level_2:
|
||||
return f"{label_2}/Rules.{level_2}"
|
||||
label_3, level_3 = self.pe_scan(file)
|
||||
if "White" not in label_3 and "Unknown" not in label_3:
|
||||
return f"{label_3}/Pefile.{level_3}"
|
||||
elif "Unknown" in label_3 and self.json["high_sensitive"]:
|
||||
return f"{label_3}/Pefile.{level_3}"
|
||||
elif file != self.pyas and not level:
|
||||
label_2, level_2 = self.pe_scan(file)
|
||||
#print(label_2, level_2, file)
|
||||
if "White" not in label_2 and "Unknown" not in label_2:
|
||||
return f"{label_2}"
|
||||
elif "Unknown" in label_2 and self.json["high_sensitive"]:
|
||||
return f"{label_2}"
|
||||
label_2, level_2 = self.rule_scan(file)
|
||||
if label_2 and level_2:
|
||||
return f"{label_2}/Rules.{level_2}"
|
||||
label_3, level_3 = self.pe_scan(file)
|
||||
if "White" not in label_3 and "Unknown" not in label_3:
|
||||
return f"{label_3}/Pefile.{level_3}"
|
||||
elif "Unknown" in label_3 and self.json["high_sensitive"]:
|
||||
return f"{label_3}/Pefile.{level_3}"
|
||||
return False
|
||||
except:
|
||||
return False
|
||||
@@ -888,7 +893,8 @@ class MainWindow_Controller(QMainWindow):
|
||||
except:
|
||||
pass
|
||||
QApplication.processEvents()
|
||||
return self.pe.predict(fn)
|
||||
label, level = self.pe.predict(fn)
|
||||
return label, int(level*100)
|
||||
except:
|
||||
return False, False
|
||||
|
||||
@@ -899,6 +905,29 @@ class MainWindow_Controller(QMainWindow):
|
||||
except:
|
||||
return True
|
||||
|
||||
def rule_scan(self, file):
|
||||
try:
|
||||
ftype = str(f".{file.split('.')[-1]}").lower()
|
||||
with open(file, 'r', encoding="iso-8859-1") as f:
|
||||
content = f.read().lower()
|
||||
for rule, value in pyasrule_dict.items():
|
||||
QApplication.processEvents()
|
||||
if ftype in value["settings"]["types"]:
|
||||
for match, matchs in value["matchs"].items():
|
||||
counts = 0
|
||||
for string in matchs:
|
||||
text = value["strings"][string]
|
||||
if value["settings"]["nocase"]:
|
||||
text = text.lower()
|
||||
if text in content:
|
||||
counts += 1
|
||||
if counts >= value["settings"]["count"]:
|
||||
label = value["abouts"]["label"]
|
||||
return label, rule
|
||||
return False, False
|
||||
except:
|
||||
return False, False
|
||||
|
||||
def proc_scan(self, p):
|
||||
try:
|
||||
if isinstance(p, str) and os.path.exists(p):
|
||||
|
||||
+211
@@ -0,0 +1,211 @@
|
||||
pyasrule_dict = {
|
||||
"A": { # 規則項目名稱 Rules_1
|
||||
"abouts": {
|
||||
"author": "PYAS Security", # 作者 PYAS Security
|
||||
"version": "1.0.0", # 版本 1.0.0
|
||||
"label": "Trojan", # 類別資訊
|
||||
"description": "Malware pattern"}, # 說明 Malware pattern
|
||||
"strings": {
|
||||
1: "physicaldrive0", # 所有包含匹配字串 1
|
||||
2: "512", # 所有包含匹配字串 2
|
||||
3: "MBR", # 所有包含匹配字串 3
|
||||
4: "x55", # 所有包含匹配字串 4
|
||||
5: "pyi-runtime-tmpdir"}, # 所有包含匹配字串 5
|
||||
"settings": {
|
||||
"count": 4, # 最低匹配數量 4
|
||||
"nocase": True, # 不分大寫小寫 True
|
||||
"types": [".exe", ".dll", ".sys"]}, # 匹配文件類別 .
|
||||
"matchs": {
|
||||
"match1": list(range(1, 5)), # 局部匹配範圍 1 (1~4)
|
||||
"match2": list(range(2, 6))}}, # 局部匹配範圍 2 (2~5)
|
||||
|
||||
"B": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "%0|%0",
|
||||
2: "ExclusionPath",
|
||||
3: "cmdkey",
|
||||
4: "eiculwo"},
|
||||
"settings": {
|
||||
"count": 1,
|
||||
"nocase": True,
|
||||
"types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 5))}},
|
||||
|
||||
"C": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "ProcessHacker",
|
||||
2: "MpCmdRun",
|
||||
3: "ConfigSecurityPolicy",
|
||||
4: "Client",
|
||||
5: "procexp",
|
||||
6: "MSASCui",
|
||||
7: "MsMpEng",
|
||||
8: "MpUXSrv",
|
||||
9: "CloseMutex",
|
||||
10: "NisSrv",
|
||||
11: "Regedit",
|
||||
12: "PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY",
|
||||
13: "dwProcessHandle",
|
||||
14: "Anti_Process",
|
||||
15: "MutexControl",
|
||||
16: "MSConfig"},
|
||||
"settings": {
|
||||
"count": 6,
|
||||
"nocase": True,
|
||||
"types": [".exe", ".dll", ".sys"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 17))}},
|
||||
|
||||
"D": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "shell\\open",
|
||||
2: "exefile",
|
||||
3: "batfile",
|
||||
4: "comfile",
|
||||
5: "regfile",
|
||||
6: "mscfile",
|
||||
7: "cmdfile",
|
||||
8: "Image File Execution Options",
|
||||
9: "CurrentVersion"},
|
||||
"settings": {
|
||||
"count": 3,
|
||||
"nocase": True,
|
||||
"types": [".exe", ".dll", ".sys"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 10))}},
|
||||
|
||||
"E": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "kill",
|
||||
2: "PYAS",
|
||||
3: "lsass",
|
||||
4: "csrss",
|
||||
5: "smss",
|
||||
6: "taskmgr",
|
||||
7: "svchost"},
|
||||
"settings": {
|
||||
"count": 3,
|
||||
"nocase": True,
|
||||
"types": [".exe", ".dll", ".sys"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 8))}},
|
||||
|
||||
"F": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "NoControlPanel",
|
||||
2: "NoFileMenu",
|
||||
3: "NoFind",
|
||||
4: "NoRealMode",
|
||||
5: "NoRecentDocsMenu",
|
||||
6: "NoSetFolders",
|
||||
7: "NoSetFolderOptions",
|
||||
8: "NoViewOnDrive",
|
||||
9: "NoDesktop",
|
||||
10: "NoAddingComponents",
|
||||
11: "NoLogOff",
|
||||
12: "NoFolderOptions",
|
||||
13: "DisableCMD",
|
||||
14: "NoViewContexMenu",
|
||||
15: "HideClock",
|
||||
16: "Wallpaper",
|
||||
17: "NoStartMenuMorePrograms",
|
||||
18: "NoStartMenuMyGames",
|
||||
19: "NoStartMenuMyMusic",
|
||||
20: "NoStartMenuNetworkPlaces",
|
||||
21: "NoStartMenuPinnedList",
|
||||
22: "NoActiveDesktop",
|
||||
23: "NoSetActiveDesktop",
|
||||
24: "NoActiveDesktopChanges",
|
||||
25: "NoChangeStartMenu",
|
||||
26: "ClearRecentDocsOnExit",
|
||||
27: "NoFavoritesMenu",
|
||||
28: "DisableLockWorkstation",
|
||||
29: "NoSetTaskbar",
|
||||
30: "NoSMHelp",
|
||||
31: "NoTrayContextMenu",
|
||||
32: "NoViewContextMenu",
|
||||
33: "NoWindowsUpdate",
|
||||
34: "NoComponents",
|
||||
35: "NoWinKeys",
|
||||
36: "StartMenuLogOff",
|
||||
37: "NoSimpleNetlDList",
|
||||
38: "NoLowDiskSpaceChecks",
|
||||
39: "Restrict_Run",
|
||||
40: "NoManageMyComputerVerb",
|
||||
41: "DisableTaskMgr",
|
||||
42: "DisableRegistryTools",
|
||||
43: "DisableChangePassword"},
|
||||
"settings": {
|
||||
"count": 2,
|
||||
"nocase": True,
|
||||
"types": [".exe", ".dll", ".sys"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 44))}},
|
||||
|
||||
"G": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Ransom",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "certutil",
|
||||
2: "encode",
|
||||
3: "decode",
|
||||
4: "random"},
|
||||
"settings": {
|
||||
"count": 4,
|
||||
"nocase": True,
|
||||
"types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 5))}},
|
||||
|
||||
"H": {
|
||||
"abouts": {
|
||||
"author": "PYAS Security",
|
||||
"version": "1.0.0",
|
||||
"label": "Trojan",
|
||||
"description": "Malware pattern"},
|
||||
"strings": {
|
||||
1: "%userprofile%",
|
||||
2: "C:\\Windows",
|
||||
3: "%SYSTEMROOT%",
|
||||
4: "%WINDIR%",
|
||||
5: "%SYSTEMDRIVE%",
|
||||
6: "%TEMP%",
|
||||
7: "%TMP%",
|
||||
8: "del"},
|
||||
"settings": {
|
||||
"count": 4,
|
||||
"nocase": True,
|
||||
"types": [".bat", ".cmd", ".ps1", ".js", ".vbs"]},
|
||||
"matchs": {
|
||||
"match1": list(range(1, 9))}},
|
||||
|
||||
}
|
||||
Reference in new issue
Block a user