Unfamilia2U/Malware
GitHub: Unfamilia2U/Malware
一个用于恶意软件PE文件静态逆向分析的Python脚本，整合了哈希计算、PE结构解析、反汇编和字符串提取等功能。
Stars: 0 | Forks: 0
# 恶意软件逆向工程文件
此脚本基于下载的 zip 文件，用于检查各种类型的恶意软件。
- 如果没有 zip 文件，可以跳过第二步。
- 应根据需要修改代码。
### 脚本的基本流程：
```
1. CREATE AND CHANGE FOLDER TO THE NEW FOLDER NAME (i.e. vshare)
2. FIND AND REPLACE VIRUS NAME (i.e. "virus#.zip"
3. FIND AND REPLACE PE FILE NAME (use unzip -l where file is downloaded to on your computer for the pefile name)
4. RUN CODE IN ORDER
```
mkdir / *filepath*/ *filename* | mv ./ *filepath*/ *filename*.zip ~/ *filepath*/ *filename*
unzip -P "*password*" ~/ *filepath*/ *filename*.zip -d ~/ *filepath*/ *filename*
cd ~/ *filepath*
python3
```
1. search file directory where file is stored
2. take hash and store in an array <== change entry.name.startswith(' ') to match the name of your file
3. loop through hash and print
import pefile
import os
with os.scandir("./") as it:
for entry in it:
if entry.name.startswith(('0','1','2','3','4','5','6','7','8','9')): #edit to represent your filename
print(entry.name)
```
----- 在下方更改文件名以匹配新文件名 -----
即 pe=pefile.PE('*filename*')
```
for section in pe.sections:
f=open(*"filename"*,"w")
print(pe,file=f)
for entry in pe.DIRECTORY_ENTRY_IMPORT:
f2=open(*'filename'*,'a')
for function in entry.imports:
print(function.name,file=f2)
from capstone import *
fname = *'filename'*
entrypoint = pe.OPTIONAL_HEADER.AddressOfEntryPoint
entrypoint_address = entrypoint+pe.OPTIONAL_HEADER.ImageBase
binary_code = pe.get_memory_mapped_image()[entrypoint:entrypoint+100]
disassembler = Cs(CS_ARCH_X86, CS_MODE_32)
for instruction in disassembler.disasm(binary_code, entrypoint_address):
f3=open(*filename*,'a')
print (instruction.mnemonic, instruction.op_str,file=f3)
```
### 执行第六步 - 退出 python
=========================
ctrl + d
### 执行第七步
===========================
strings ./ *filename* > *new filename*| hexdump ./*filename* > *new filename* | xxd ./ *filepath*/ *filename* > *new filename*
### 执行第八步（已包含在上方；仅在需要时单独运行）
===========================
hexdump ./ *filename* > *new filename*
### 执行第九步（已包含在上方；仅在需要时单独运行）
============================
xxd ./ *filename* > *new filename*
===============================
标签：Cutter, DAST, PE文件解析, Python, Wayback Machine, 云资产清单, 反汇编, 恶意软件分析, 无后门, 逆向工具, 逆向工程