lib.core.packages

Package lib :: Package core :: Module packages |
[hide private]
[frames] | no frames]

# Source Code for Module lib.core.packages

     1  # Copyright (C) 2010-2013 Claudio Guarnieri.
     2  # Copyright (C) 2014-2016 Cuckoo Foundation.
     3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     4  # See the file 'docs/LICENSE' for copying permission.
     5
     6 -def has_com_exports(exports):
     7      com_exports = [
     8          "DllInstall",
     9          "DllCanUnloadNow",
    10          "DllGetClassObject",
    11          "DllRegisterServer",
    12          "DllUnregisterServer",
    13      ]
    14
    15      for name in com_exports:
    16          if name not in exports:
    17              return False
    18      return True
    19
    20 -def choose_package(file_type, file_name, exports):
    21      """Choose analysis package due to file type and file extension.
    22      @param file_type: file type.
    23      @param file_name: file name.
    24      @return: package name or None.
    25      """
    26      if not file_type:
    27          return None
    28
    29      file_name = file_name.lower()
    30
    31      if "DLL" in file_type:
    32          if file_name.endswith(".cpl"):
    33              return "cpl"
    34          elif has_com_exports(exports):
    35              return "com"
    36          else:
    37              return "dll"
    38      elif "PE32" in file_type or "MS-DOS" in file_type:
    39          return "exe"
    40      elif "PDF" in file_type or file_name.endswith(".pdf"):
    41          return "pdf"
    42      elif file_name.endswith(".pub"):
    43          return "pub"
    44      elif "Rich Text Format" in file_type or \
    45              "Microsoft Word" in file_type or \
    46              "Microsoft Office Word" in file_type or \
    47              file_name.endswith((".doc", ".docx", ".rtf", ".docm")):
    48          return "doc"
    49      elif "Microsoft Office Excel" in file_type or \
    50              "Microsoft Excel" in file_type or \
    51              file_name.endswith((".xls", ".xlsx")):
    52          return "xls"
    53      elif "Microsoft PowerPoint" in file_type or \
    54              file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")):
    55          return "ppt"
    56      elif file_name.endswith(".jar"):
    57          return "jar"
    58      elif "Zip" in file_type:
    59          return "zip"
    60      elif file_name.endswith((".py", ".pyc")) or "Python script" in file_type:
    61          return "python"
    62      elif file_name.endswith(".vbs"):
    63          return "vbs"
    64      elif file_name.endswith((".js", ".jse")):
    65          return "js"
    66      elif file_name.endswith(".msi"):
    67          return "msi"
    68      elif file_name.endswith(".ps1"):
    69          return "ps1"
    70      elif file_name.endswith(".wsf"):
    71          return "wsf"
    72      elif "HTML" in file_type or file_name.endswith((".htm", ".html", ".hta")):
    73          return "ie"
    74      else:
    75          return "generic"
    76