diff --git a/README.md b/README.md index 9bc5a0f..32fa291 100644 --- a/README.md +++ b/README.md @@ -31,6 +31,58 @@ pywin32==306 PyQt5==5.15.9 ``` +## Hash Scanning + +``` +import hashlib, requests +import xml.etree.ElementTree as xmlet + +def hash_scan(file): + try: + with open(file, "rb") as f: + text = str(hashlib.md5(f.read()).hexdigest()) + strBody = f'-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="md5s"\r\n\r\n{text}\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="format"\r\n\r\nXML\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="product"\r\n\r\n360zip\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="combo"\r\n\r\n360zip_main\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="v"\r\n\r\n2\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="osver"\r\n\r\n5.1\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="vk"\r\n\r\na03bc211\r\n-------------------------------7d83e2d7a141e\r\nContent-Disposition: form-data; name="mid"\r\n\r\n8a40d9eff408a78fe9ec10a0e7e60f62\r\n-------------------------------7d83e2d7a141e--' + response = requests.post('http://qup.f.360.cn/file_health_info.php', data=strBody, timeout=3) + if response.status_code == 200: + level = float(xmlet.fromstring(response.text).find('.//e_level').text) + if level > 50: + return "Virus" + elif level <= 10: + return "Safe" + return "Unknown" + return f"Error: {response.status_code}" + except Exception as e: + return f"Error: {e}" + +info = hash_scan("path to file") +print(info) +``` + +## Pefile Scanning +``` +import pefile + +def pe_scan(file): + try: + fn = [] + with pefile.PE(file) as pe: + for entry in pe.DIRECTORY_ENTRY_IMPORT: + for func in entry.imports: + try: + fn.append(str(func.name, "utf-8")) + except: + pass + if fn in known_malicious_list: + return "Virus" + return "Safe" + return "Unknown" + except Exception as e: + return f"Error: {e}" + +info = pe_scan("path to file") +print(info) +``` + ## Official Website https://pyantivirus.wixsite.com/pyas