#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import json
import pefile

import array
import binascii

from . import apialert
from . import yara_check

def xor_delta(s, key_len = 1):
	delta = array.array('B', s)
	 
	for x in range(key_len, len(s)):
		delta[x - key_len] ^= delta[x]
		 
	""" return the delta as a string """
	return delta.tostring()[:-key_len]
 
def get_xor(filename):
	check = {}
	search_file = open(filename, "rb").read()
	key_lengths=[1,2,4,8]
	search_string = b"This program cannot be run in DOS mode."
	 
	for l in key_lengths:
		key_delta = xor_delta(search_string, l)
		doc_delta = xor_delta(search_file, l)
		 
		offset = -1
		while(True):
			offset += 1
			offset = doc_delta.find(key_delta, offset)
			if(offset > 0):
				# key: offset
				check.update({l: hex(offset)})
			else:
				break

	detect = [item for item in check.items() if item[1] == 78]

	if detect or check == {}:
		return {}
	return check

import re
def get_antivm(filename):

	result = {}
	
	# Credit: Joxean Koret
	VM_Sign = {
		"VMware trick": b"VMXh",
		"Xen": b"XenVMM",
		"Red Pill": b"\x0f\x01\x0d\x00\x00\x00\x00\xc3",
		"VirtualPc trick": b"\x0f\x3f\x07\x0b",
		"VMCheck.dll": b"\x45\xC7\x00\x01",
		"VMCheck.dll for VirtualPC": b"\x0f\x3f\x07\x0b\xc7\x45\xfc\xff\xff\xff\xff",
		"Bochs & QEmu CPUID Trick": b"\x44\x4d\x41\x63",
		"Torpig VMM Trick": b"\xE8\xED\xFF\xFF\xFF\x25\x00\x00\x00\xFF\x33\xC9\x3D\x00\x00\x00\x80\x0F\x95\xC1\x8B\xC1\xC3",
		"Torpig (UPX) VMM Trick": b"\x51\x51\x0F\x01\x27\x00\xC1\xFB\xB5\xD5\x35\x02\xE2\xC3\xD1\x66\x25\x32\xBD\x83\x7F\xB7\x4E\x3D\x06\x80\x0F\x95\xC1\x8B\xC1\xC3"
		}
		
	with open(filename, "rb") as f:
		buf = f.read()

		for trick in VM_Sign:
			pos = buf.find(VM_Sign[trick])
			if pos > -1:
				result.update({"trick": trick, "offset": hex(pos)})

	return result

def path_to_file(filename, folder):
	_ROOT = os.path.abspath(os.path.dirname(__file__))
	return os.path.join(_ROOT, folder, filename)

def load_config(config_file):
	with open(config_file) as conf:
		data = json.load(conf)
	return data

def get_result(pe, filename):
	features = {}
	features.update({
		"mutex": apialert.get_result(pe, load_config(path_to_file('stringsmatch.json', '../signatures'))['mutex']),
		"antidbg": apialert.get_result(pe, load_config(path_to_file('stringsmatch.json', '../signatures'))['antidbg']),
		"antivm": get_antivm(filename),
		"xor": get_xor(filename),
		"packer": yara_check.yara_match_from_file(path_to_file('peid.yara', '../signatures/yara_plugins/pe'), filename),
		"crypto": yara_check.yara_match_from_file(path_to_file('crypto_signatures.yar', '../signatures/yara_plugins/pe'), filename),
	})
	return features


fb4558da7117991e79e295d0d0d23e288229ecbd
<mask token>


def xor_delta(s, key_len=1):
    delta = array.array('B', s)
    for x in range(key_len, len(s)):
        delta[x - key_len] ^= delta[x]
    """ return the delta as a string """
    return delta.tostring()[:-key_len]


<mask token>


def get_antivm(filename):
    result = {}
    VM_Sign = {'VMware trick': b'VMXh', 'Xen': b'XenVMM', 'Red Pill':
        b'\x0f\x01\r\x00\x00\x00\x00\xc3', 'VirtualPc trick':
        b'\x0f?\x07\x0b', 'VMCheck.dll': b'E\xc7\x00\x01',
        'VMCheck.dll for VirtualPC':
        b'\x0f?\x07\x0b\xc7E\xfc\xff\xff\xff\xff',
        'Bochs & QEmu CPUID Trick': b'DMAc', 'Torpig VMM Trick':
        b'\xe8\xed\xff\xff\xff%\x00\x00\x00\xff3\xc9=\x00\x00\x00\x80\x0f\x95\xc1\x8b\xc1\xc3'
        , 'Torpig (UPX) VMM Trick':
        b"QQ\x0f\x01'\x00\xc1\xfb\xb5\xd55\x02\xe2\xc3\xd1f%2\xbd\x83\x7f\xb7N=\x06\x80\x0f\x95\xc1\x8b\xc1\xc3"
        }
    with open(filename, 'rb') as f:
        buf = f.read()
        for trick in VM_Sign:
            pos = buf.find(VM_Sign[trick])
            if pos > -1:
                result.update({'trick': trick, 'offset': hex(pos)})
    return result


def path_to_file(filename, folder):
    _ROOT = os.path.abspath(os.path.dirname(__file__))
    return os.path.join(_ROOT, folder, filename)


<mask token>


def get_result(pe, filename):
    features = {}
    features.update({'mutex': apialert.get_result(pe, load_config(
        path_to_file('stringsmatch.json', '../signatures'))['mutex']),
        'antidbg': apialert.get_result(pe, load_config(path_to_file(
        'stringsmatch.json', '../signatures'))['antidbg']), 'antivm':
        get_antivm(filename), 'xor': get_xor(filename), 'packer':
        yara_check.yara_match_from_file(path_to_file('peid.yara',
        '../signatures/yara_plugins/pe'), filename), 'crypto': yara_check.
        yara_match_from_file(path_to_file('crypto_signatures.yar',
        '../signatures/yara_plugins/pe'), filename)})
    return features

<mask token>


def xor_delta(s, key_len=1):
    delta = array.array('B', s)
    for x in range(key_len, len(s)):
        delta[x - key_len] ^= delta[x]
    """ return the delta as a string """
    return delta.tostring()[:-key_len]


<mask token>


def get_antivm(filename):
    result = {}
    VM_Sign = {'VMware trick': b'VMXh', 'Xen': b'XenVMM', 'Red Pill':
        b'\x0f\x01\r\x00\x00\x00\x00\xc3', 'VirtualPc trick':
        b'\x0f?\x07\x0b', 'VMCheck.dll': b'E\xc7\x00\x01',
        'VMCheck.dll for VirtualPC':
        b'\x0f?\x07\x0b\xc7E\xfc\xff\xff\xff\xff',
        'Bochs & QEmu CPUID Trick': b'DMAc', 'Torpig VMM Trick':
        b'\xe8\xed\xff\xff\xff%\x00\x00\x00\xff3\xc9=\x00\x00\x00\x80\x0f\x95\xc1\x8b\xc1\xc3'
        , 'Torpig (UPX) VMM Trick':
        b"QQ\x0f\x01'\x00\xc1\xfb\xb5\xd55\x02\xe2\xc3\xd1f%2\xbd\x83\x7f\xb7N=\x06\x80\x0f\x95\xc1\x8b\xc1\xc3"
        }
    with open(filename, 'rb') as f:
        buf = f.read()
        for trick in VM_Sign:
            pos = buf.find(VM_Sign[trick])
            if pos > -1:
                result.update({'trick': trick, 'offset': hex(pos)})
    return result


def path_to_file(filename, folder):
    _ROOT = os.path.abspath(os.path.dirname(__file__))
    return os.path.join(_ROOT, folder, filename)


def load_config(config_file):
    with open(config_file) as conf:
        data = json.load(conf)
    return data


def get_result(pe, filename):
    features = {}
    features.update({'mutex': apialert.get_result(pe, load_config(
        path_to_file('stringsmatch.json', '../signatures'))['mutex']),
        'antidbg': apialert.get_result(pe, load_config(path_to_file(
        'stringsmatch.json', '../signatures'))['antidbg']), 'antivm':
        get_antivm(filename), 'xor': get_xor(filename), 'packer':
        yara_check.yara_match_from_file(path_to_file('peid.yara',
        '../signatures/yara_plugins/pe'), filename), 'crypto': yara_check.
        yara_match_from_file(path_to_file('crypto_signatures.yar',
        '../signatures/yara_plugins/pe'), filename)})
    return features

<mask token>


def xor_delta(s, key_len=1):
    delta = array.array('B', s)
    for x in range(key_len, len(s)):
        delta[x - key_len] ^= delta[x]
    """ return the delta as a string """
    return delta.tostring()[:-key_len]


def get_xor(filename):
    check = {}
    search_file = open(filename, 'rb').read()
    key_lengths = [1, 2, 4, 8]
    search_string = b'This program cannot be run in DOS mode.'
    for l in key_lengths:
        key_delta = xor_delta(search_string, l)
        doc_delta = xor_delta(search_file, l)
        offset = -1
        while True:
            offset += 1
            offset = doc_delta.find(key_delta, offset)
            if offset > 0:
                check.update({l: hex(offset)})
            else:
                break
    detect = [item for item in check.items() if item[1] == 78]
    if detect or check == {}:
        return {}
    return check


<mask token>


def get_antivm(filename):
    result = {}
    VM_Sign = {'VMware trick': b'VMXh', 'Xen': b'XenVMM', 'Red Pill':
        b'\x0f\x01\r\x00\x00\x00\x00\xc3', 'VirtualPc trick':
        b'\x0f?\x07\x0b', 'VMCheck.dll': b'E\xc7\x00\x01',
        'VMCheck.dll for VirtualPC':
        b'\x0f?\x07\x0b\xc7E\xfc\xff\xff\xff\xff',
        'Bochs & QEmu CPUID Trick': b'DMAc', 'Torpig VMM Trick':
        b'\xe8\xed\xff\xff\xff%\x00\x00\x00\xff3\xc9=\x00\x00\x00\x80\x0f\x95\xc1\x8b\xc1\xc3'
        , 'Torpig (UPX) VMM Trick':
        b"QQ\x0f\x01'\x00\xc1\xfb\xb5\xd55\x02\xe2\xc3\xd1f%2\xbd\x83\x7f\xb7N=\x06\x80\x0f\x95\xc1\x8b\xc1\xc3"
        }
    with open(filename, 'rb') as f:
        buf = f.read()
        for trick in VM_Sign:
            pos = buf.find(VM_Sign[trick])
            if pos > -1:
                result.update({'trick': trick, 'offset': hex(pos)})
    return result


def path_to_file(filename, folder):
    _ROOT = os.path.abspath(os.path.dirname(__file__))
    return os.path.join(_ROOT, folder, filename)


def load_config(config_file):
    with open(config_file) as conf:
        data = json.load(conf)
    return data


def get_result(pe, filename):
    features = {}
    features.update({'mutex': apialert.get_result(pe, load_config(
        path_to_file('stringsmatch.json', '../signatures'))['mutex']),
        'antidbg': apialert.get_result(pe, load_config(path_to_file(
        'stringsmatch.json', '../signatures'))['antidbg']), 'antivm':
        get_antivm(filename), 'xor': get_xor(filename), 'packer':
        yara_check.yara_match_from_file(path_to_file('peid.yara',
        '../signatures/yara_plugins/pe'), filename), 'crypto': yara_check.
        yara_match_from_file(path_to_file('crypto_signatures.yar',
        '../signatures/yara_plugins/pe'), filename)})
    return features

import os
import json
import pefile
import array
import binascii
from . import apialert
from . import yara_check


def xor_delta(s, key_len=1):
    delta = array.array('B', s)
    for x in range(key_len, len(s)):
        delta[x - key_len] ^= delta[x]
    """ return the delta as a string """
    return delta.tostring()[:-key_len]


def get_xor(filename):
    check = {}
    search_file = open(filename, 'rb').read()
    key_lengths = [1, 2, 4, 8]
    search_string = b'This program cannot be run in DOS mode.'
    for l in key_lengths:
        key_delta = xor_delta(search_string, l)
        doc_delta = xor_delta(search_file, l)
        offset = -1
        while True:
            offset += 1
            offset = doc_delta.find(key_delta, offset)
            if offset > 0:
                check.update({l: hex(offset)})
            else:
                break
    detect = [item for item in check.items() if item[1] == 78]
    if detect or check == {}:
        return {}
    return check


import re


def get_antivm(filename):
    result = {}
    VM_Sign = {'VMware trick': b'VMXh', 'Xen': b'XenVMM', 'Red Pill':
        b'\x0f\x01\r\x00\x00\x00\x00\xc3', 'VirtualPc trick':
        b'\x0f?\x07\x0b', 'VMCheck.dll': b'E\xc7\x00\x01',
        'VMCheck.dll for VirtualPC':
        b'\x0f?\x07\x0b\xc7E\xfc\xff\xff\xff\xff',
        'Bochs & QEmu CPUID Trick': b'DMAc', 'Torpig VMM Trick':
        b'\xe8\xed\xff\xff\xff%\x00\x00\x00\xff3\xc9=\x00\x00\x00\x80\x0f\x95\xc1\x8b\xc1\xc3'
        , 'Torpig (UPX) VMM Trick':
        b"QQ\x0f\x01'\x00\xc1\xfb\xb5\xd55\x02\xe2\xc3\xd1f%2\xbd\x83\x7f\xb7N=\x06\x80\x0f\x95\xc1\x8b\xc1\xc3"
        }
    with open(filename, 'rb') as f:
        buf = f.read()
        for trick in VM_Sign:
            pos = buf.find(VM_Sign[trick])
            if pos > -1:
                result.update({'trick': trick, 'offset': hex(pos)})
    return result


def path_to_file(filename, folder):
    _ROOT = os.path.abspath(os.path.dirname(__file__))
    return os.path.join(_ROOT, folder, filename)


def load_config(config_file):
    with open(config_file) as conf:
        data = json.load(conf)
    return data


def get_result(pe, filename):
    features = {}
    features.update({'mutex': apialert.get_result(pe, load_config(
        path_to_file('stringsmatch.json', '../signatures'))['mutex']),
        'antidbg': apialert.get_result(pe, load_config(path_to_file(
        'stringsmatch.json', '../signatures'))['antidbg']), 'antivm':
        get_antivm(filename), 'xor': get_xor(filename), 'packer':
        yara_check.yara_match_from_file(path_to_file('peid.yara',
        '../signatures/yara_plugins/pe'), filename), 'crypto': yara_check.
        yara_match_from_file(path_to_file('crypto_signatures.yar',
        '../signatures/yara_plugins/pe'), filename)})
    return features

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import os
import json
import pefile

import array
import binascii

from . import apialert
from . import yara_check

def xor_delta(s, key_len = 1):
	delta = array.array('B', s)
	 
	for x in range(key_len, len(s)):
		delta[x - key_len] ^= delta[x]
		 
	""" return the delta as a string """
	return delta.tostring()[:-key_len]
 
def get_xor(filename):
	check = {}
	search_file = open(filename, "rb").read()
	key_lengths=[1,2,4,8]
	search_string = b"This program cannot be run in DOS mode."
	 
	for l in key_lengths:
		key_delta = xor_delta(search_string, l)
		doc_delta = xor_delta(search_file, l)
		 
		offset = -1
		while(True):
			offset += 1
			offset = doc_delta.find(key_delta, offset)
			if(offset > 0):
				# key: offset
				check.update({l: hex(offset)})
			else:
				break

	detect = [item for item in check.items() if item[1] == 78]

	if detect or check == {}:
		return {}
	return check

import re
def get_antivm(filename):

	result = {}
	
	# Credit: Joxean Koret
	VM_Sign = {
		"VMware trick": b"VMXh",
		"Xen": b"XenVMM",
		"Red Pill": b"\x0f\x01\x0d\x00\x00\x00\x00\xc3",
		"VirtualPc trick": b"\x0f\x3f\x07\x0b",
		"VMCheck.dll": b"\x45\xC7\x00\x01",
		"VMCheck.dll for VirtualPC": b"\x0f\x3f\x07\x0b\xc7\x45\xfc\xff\xff\xff\xff",
		"Bochs & QEmu CPUID Trick": b"\x44\x4d\x41\x63",
		"Torpig VMM Trick": b"\xE8\xED\xFF\xFF\xFF\x25\x00\x00\x00\xFF\x33\xC9\x3D\x00\x00\x00\x80\x0F\x95\xC1\x8B\xC1\xC3",
		"Torpig (UPX) VMM Trick": b"\x51\x51\x0F\x01\x27\x00\xC1\xFB\xB5\xD5\x35\x02\xE2\xC3\xD1\x66\x25\x32\xBD\x83\x7F\xB7\x4E\x3D\x06\x80\x0F\x95\xC1\x8B\xC1\xC3"
		}
		
	with open(filename, "rb") as f:
		buf = f.read()

		for trick in VM_Sign:
			pos = buf.find(VM_Sign[trick])
			if pos > -1:
				result.update({"trick": trick, "offset": hex(pos)})

	return result

def path_to_file(filename, folder):
	_ROOT = os.path.abspath(os.path.dirname(__file__))
	return os.path.join(_ROOT, folder, filename)

def load_config(config_file):
	with open(config_file) as conf:
		data = json.load(conf)
	return data

def get_result(pe, filename):
	features = {}
	features.update({
		"mutex": apialert.get_result(pe, load_config(path_to_file('stringsmatch.json', '../signatures'))['mutex']),
		"antidbg": apialert.get_result(pe, load_config(path_to_file('stringsmatch.json', '../signatures'))['antidbg']),
		"antivm": get_antivm(filename),
		"xor": get_xor(filename),
		"packer": yara_check.yara_match_from_file(path_to_file('peid.yara', '../signatures/yara_plugins/pe'), filename),
		"crypto": yara_check.yara_match_from_file(path_to_file('crypto_signatures.yar', '../signatures/yara_plugins/pe'), filename),
	})
	return features

