"""PE analysis."""

def __init__(self, file_path):

"""@param file_path: file path."""

self.file_path = file_path

self.pe = None

def _get_filetype(self, data):

"""Gets filetype, uses libmagic if available.

if not HAVE_MAGIC:

return None

try:

ms = magic.open(magic.MAGIC_NONE)

ms.load()

file_type = ms.buffer(data)

except:

try:

file_type = magic.from_buffer(data)

except Exception:

return None

finally:

try:

ms.close()

except:

pass

return file_type

def _get_peid_signatures(self):

"""Gets PEID signatures.

try:

sig_path = os.path.join(CUCKOO_ROOT, "data",

"peutils", "UserDB.TXT")

signatures = peutils.SignatureDatabase(sig_path)

return signatures.match(self.pe, ep_only=True)

except:

return None

def _get_imported_symbols(self):

"""Gets imported symbols.

imports = []

if hasattr(self.pe, "DIRECTORY_ENTRY_IMPORT"):

for entry in self.pe.DIRECTORY_ENTRY_IMPORT:

try:

symbols = []

for imported_symbol in entry.imports:

symbol = {}

symbol["address"] = hex(imported_symbol.address)

symbol["name"] = imported_symbol.name

symbols.append(symbol)

imports_section = {}

imports_section["dll"] = convert_to_printable(entry.dll)

imports_section["imports"] = symbols

imports.append(imports_section)

except:

continue

return imports

def _get_exported_symbols(self):

"""Gets exported symbols.

exports = []

if hasattr(self.pe, "DIRECTORY_ENTRY_EXPORT"):

for exported_symbol in self.pe.DIRECTORY_ENTRY_EXPORT.symbols:

symbol = {}

symbol["address"] = hex(self.pe.OPTIONAL_HEADER.ImageBase +

exported_symbol.address)

symbol["name"] = exported_symbol.name

symbol["ordinal"] = exported_symbol.ordinal

exports.append(symbol)

return exports

def _get_sections(self):

"""Gets sections.

sections = []

for entry in self.pe.sections:

try:

section = {}

section["name"] = convert_to_printable(entry.Name.strip("\x00"))

section["virtual_address"] = "0x{0:08x}".format(entry.VirtualAddress)

section["virtual_size"] = "0x{0:08x}".format(entry.Misc_VirtualSize)

section["size_of_data"] = "0x{0:08x}".format(entry.SizeOfRawData)

section["entropy"] = entry.get_entropy()

sections.append(section)

except:

continue

return sections

def _get_resources(self):

"""Get resources.

resources = []

if hasattr(self.pe, "DIRECTORY_ENTRY_RESOURCE"):

for resource_type in self.pe.DIRECTORY_ENTRY_RESOURCE.entries:

try:

resource = {}

if resource_type.name is not None:

name = str(resource_type.name)

else:

name = str(pefile.RESOURCE_TYPE.get(resource_type.struct.Id))

if hasattr(resource_type, "directory"):

for resource_id in resource_type.directory.entries:

if hasattr(resource_id, "directory"):

for resource_lang in resource_id.directory.entries:

data = self.pe.get_data(resource_lang.data.struct.OffsetToData, resource_lang.data.struct.Size)

filetype = self._get_filetype(data)

language = pefile.LANG.get(resource_lang.data.lang, None)

sublanguage = pefile.get_sublang_name_for_lang(resource_lang.data.lang, resource_lang.data.sublang)

resource["name"] = name

resource["offset"] = "0x{0:08x}".format(resource_lang.data.struct.OffsetToData)

resource["size"] = "0x{0:08x}".format(resource_lang.data.struct.Size)

resource["filetype"] = filetype

resource["language"] = language

resource["sublanguage"] = sublanguage

resources.append(resource)

except:

continue

return resources

def _get_versioninfo(self):

"""Get version info.

infos = []

if hasattr(self.pe, "VS_VERSIONINFO"):

if hasattr(self.pe, "FileInfo"):

for entry in self.pe.FileInfo:

try:

if hasattr(entry, "StringTable"):

for st_entry in entry.StringTable:

for str_entry in st_entry.entries.items():

entry = {}

entry["name"] = convert_to_printable(str_entry[0])

entry["value"] = convert_to_printable(str_entry[1])

infos.append(entry)

elif hasattr(entry, "Var"):

for var_entry in entry.Var:

if hasattr(var_entry, "entry"):

entry = {}

entry["name"] = convert_to_printable(var_entry.entry.keys()[0])

entry["value"] = convert_to_printable(var_entry.entry.values()[0])

infos.append(entry)

except:

continue

return infos

def _get_imphash(self):

"""Gets imphash.

try:

return self.pe.get_imphash()

except AttributeError:

return None

def _get_timestamp(self):

"""Get compilation timestamp.

try:

pe_timestamp = self.pe.FILE_HEADER.TimeDateStamp

except AttributeError:

return None

dt = datetime.datetime.fromtimestamp(pe_timestamp)

return dt.strftime("%Y-%m-%d %H:%M:%S")

def _get_pdb_path(self):

"""Get the path to any available debugging symbols."""

try:

for entry in getattr(self.pe, "DIRECTORY_ENTRY_DEBUG", []):

raw_offset = entry.struct.PointerToRawData

size_data = entry.struct.SizeOfData

debug_data = self.pe.__data__[raw_offset:raw_offset+size_data]

if debug_data.startswith("RSDS"):

return debug_data[24:].strip("\x00")

except:

log.exception("Exception parsing PDB path")

def _get_signature(self):

"""If this executable is signed, get its signature(s)."""

dir_index = pefile.DIRECTORY_ENTRY["IMAGE_DIRECTORY_ENTRY_SECURITY"]

if len(self.pe.OPTIONAL_HEADER.DATA_DIRECTORY) < dir_index:

return []

dir_entry = self.pe.OPTIONAL_HEADER.DATA_DIRECTORY[dir_index]

if not dir_entry or not dir_entry.VirtualAddress or not dir_entry.Size:

return []

if not HAVE_MCRYPTO:

log.critical("You do not have the m2crypto library installed "

"preventing certificate extraction: "

"pip install m2crypto")

return []

signatures = self.pe.write()[dir_entry.VirtualAddress+8:]

bio = M2Crypto.BIO.MemoryBuffer(signatures)

if not bio:

return []

pkcs7_obj = M2Crypto.m2.pkcs7_read_bio_der(bio.bio_ptr())

if not pkcs7_obj:

return []

ret = []

p7 = M2Crypto.SMIME.PKCS7(pkcs7_obj)

for cert in p7.get0_signers(M2Crypto.X509.X509_Stack()) or []:

subject = cert.get_subject()

ret.append({

"serial_number": "%032x" % cert.get_serial_number(),

"common_name": subject.CN,

"country": subject.C,

"locality": subject.L,

"organization": subject.O,

"email": subject.Email,

"sha1": "%040x" % int(cert.get_fingerprint("sha1"), 16),

"md5": "%032x" % int(cert.get_fingerprint("md5"), 16),

})

if subject.GN and subject.SN:

ret[-1]["full_name"] = "%s %s" % (subject.GN, subject.SN)

elif subject.GN:

ret[-1]["full_name"] = subject.GN

elif subject.SN:

ret[-1]["full_name"] = subject.SN

return ret

def run(self):

"""Run analysis.

if not os.path.exists(self.file_path):

return {}

try:

self.pe = pefile.PE(self.file_path)

except pefile.PEFormatError:

return {}

results = {}

results["peid_signatures"] = self._get_peid_signatures()

results["pe_imports"] = self._get_imported_symbols()

results["pe_exports"] = self._get_exported_symbols()

results["pe_sections"] = self._get_sections()

results["pe_resources"] = self._get_resources()

results["pe_versioninfo"] = self._get_versioninfo()

results["pe_imphash"] = self._get_imphash()

results["pe_timestamp"] = self._get_timestamp()

results["pdb_path"] = self._get_pdb_path()

results["signature"] = self._get_signature()

results["imported_dll_count"] = len([x for x in results["pe_imports"] if x.get("dll")])

"""Static analysis."""

PUBKEY_RE = "(-----BEGIN PUBLIC KEY-----[a-zA-Z0-9\\n\\+/]+-----END PUBLIC KEY-----)"

PRIVKEY_RE = "(-----BEGIN RSA PRIVATE KEY-----[a-zA-Z0-9\\n\\+/]+-----END RSA PRIVATE KEY-----)"

def run(self):

"""Run analysis.

self.key = "static"

static = {}

if self.task["category"] == "file" and os.path.exists(self.file_path):

if HAVE_PEFILE:

if "PE32" in File(self.file_path).get_type():

static.update(PortableExecutable(self.file_path).run())

static["keys"] = self._get_keys()

return static

def _get_keys(self):

"""Get any embedded plaintext public and/or private keys."""

buf = open(self.file_path).read()

ret = set()

ret.update(re.findall(self.PUBKEY_RE, buf))

ret.update(re.findall(self.PRIVKEY_RE, buf))