static.py

import requests
import re
import hashlib
import io
import pefile
import struct
import os
import os.path
import time

def convert_bytes(num):
    for x in ['bytes', 'KB', 'MB', 'GB', 'TB']:
        if num < 1024.0:
            return "%3.1f %s" % (num, x)
        num /= 1024.0


def file_size(file_path):
    if os.path.isfile(file_path):
        file_info = os.stat(file_path)
        return convert_bytes(file_info.st_size)


def open_file(f):
    print('\n')
    fp = open(f)
    fp.close()

def basic_image_analysis(f):
    IMAGE_FILE_MACHINE_I386 = 332
    IMAGE_FILE_MACHINE_IA64 = 512
    IMAGE_FILE_MACHINE_AMD64 = 34404

    fl = open(f, "rb")

    s = fl.read(2)
    if s == "MZ":
        fl.close()
        return ({'result': {
            "image_type": "Not an EXE file",
            'file_size': file_size(f),
            "last_modified": time.ctime(os.path.getmtime(f)),
            "created": time.ctime(os.path.getctime(f))
        }})
    else:
        fl.seek(60)
        s = fl.read(4)
        header_offset = struct.unpack("<L", s)[0]
        fl.seek(header_offset+4)
        s = fl.read(2)
        machine = struct.unpack("<H", s)[0]
        fl.close()

        if machine == IMAGE_FILE_MACHINE_I386:
            return ({
                'result': {
                    'image_type': "IA-32 (32-bit x86)",
                    'file_size': file_size(f),
                    "last_modified": time.ctime(os.path.getmtime(f)),
                    "created": time.ctime(os.path.getctime(f))
                }
            })
        elif machine == IMAGE_FILE_MACHINE_IA64:
            return ({
                'result': {
                    'image_type': "IA-64 (Itanium)",
                    'file_size': file_size(f),
                    "last_modified": time.ctime(os.path.getmtime(f)),
                    "created": time.ctime(os.path.getctime(f))
                }
            })
        elif machine == IMAGE_FILE_MACHINE_AMD64:
            return ({
                'result': {
                    'image_type': "AMD64 (64-bit x86)",
                    'file_size': file_size(f),
                    "last_modified": time.ctime(os.path.getmtime(f)),
                    "created": time.ctime(os.path.getctime(f))
                }
            })
        else:
            return ({
                'result': {
                    'image_type': "Unknown architecture",
                    'file_size': file_size(f),
                    "last_modified": time.ctime(os.path.getmtime(f)),
                    "created": time.ctime(os.path.getctime(f))
                }
            })


def pe_analysis(f):
    result = {}
    try:
        pe = pefile.PE(f)
        result["image_base"] = hex(pe.OPTIONAL_HEADER.ImageBase)
        result["entrypoint_address"] = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
        result["number_of_rva_sizes"] = hex(pe.OPTIONAL_HEADER.NumberOfRvaAndSizes)
        result["number_of_sections"] = hex(pe.FILE_HEADER.NumberOfSections)

        result['sections'] = []
        for section in pe.sections:
            result['sections'].append({
                "name": str(section.Name),
                "virtual_address": hex(section.VirtualAddress),
                "virtual_size": hex(section.Misc_VirtualSize),
                "raw_size": hex(section.SizeOfRawData)
            })

        result['dll'] = []
        for lst in pe.DIRECTORY_ENTRY_IMPORT:
            for s in lst.imports:
                result['dll'].append({
                "name": str(s.name),
                "address": hex(s.address)
            })

        result['headers'] = []

        for headers in pe.DOS_HEADER.dump():
            result['headers'].append(headers)

        result['ntheaders'] = []

        for ntheader in pe.NT_HEADERS.dump():
            result['ntheaders'].append(ntheader)

        result['optional_headers'] = []
        for optheader in pe.OPTIONAL_HEADER.dump():
            result['optional_headers'].append(optheader)

    except Exception as e:
        print(e)
        result = {
            'result': 'DOS Header magic not found'
        }

    with io.open(f, mode="rb") as fd:
        content = fd.read()
        md5 = hashlib.md5(content).hexdigest()
        result['md5'] = md5
    
    return result

def VT_Request(f):
    with io.open(f, mode="rb") as fd:
        content = fd.read()
        hash = hashlib.md5(content).hexdigest()
    key = "VIRUS-TOTAL-KEY"
    result = {}
    if len(key) == 64:
        try:
            params = {'apikey': key, 'resource': hash}
            url = requests.get(
                'https://www.virustotal.com/vtapi/v2/file/report', params=params)
            json_response = url.json()
            response = int(json_response.get('response_code'))
            if response == 0:
                result = {"result": "File not in Virus Total"}
            elif response == 1:
                positives = int(json_response.get('positives'))
                sha1 = json_response.get('sha1')
                total = int(json_response.get('total'))
                sha256 = json_response.get('sha256')
                scans = str(json_response.get('scans'))
                result["hit_count"] = str(positives) +'/'+str(total)
                result["sha1"] = sha1
                result["sha256"] = sha256
                result["scans"] = scans
            else:
                result["result"] = "Could not be searched. Try again later."
        except Exception as e:
            result["result"] = "Internal server error"
    else:
        result = {"result": "Something wrong with API Key"}

    return result


def static_analysis(f):
    try:
        open_file(f)
        # basic_image_analysis_result = basic_image_analysis(f)
        pe_analysis_result = pe_analysis(f)
        vt_request_result = VT_Request(f)
        result = {
            "result": {
                # "basic_image_analysis": basic_image_analysis_result,
                "pe_analysis": pe_analysis_result,
                "vt_request": vt_request_result
            }
        }

        return result, 200
    except Exception as e:
        print(e)
        return {"result": "Internal Server Error"}, 500