예제 #1
0
        public static VDBT GetSignatures(string file, bool GenerateVN)
        {
            if (FileFormat.GetFileFormat(file).Name == "PE-TYPE-SCANNER")
            {
                string hash = Security.GetMD5HashFromFile(file);
                string th   = null;
                string dh   = null;
                using (KCompress.KCompressExtractor extr = new KCompress.KCompressExtractor(file))
                    extr.ExtractArchive(AVEngine.TempDir + Path.GetFileNameWithoutExtension(file) + @"\");


                List <string> lst = FileHelper.GetFilesRecursive(AVEngine.TempDir + Path.GetFileNameWithoutExtension(file) + @"\");
                foreach (string sfile in lst)
                {
                    if (sfile.EndsWith(".text"))
                    {
                        th = Security.GetMD5HashFromFile(sfile);
                    }
                    else if (sfile.EndsWith(".data"))
                    {
                        dh = Security.GetMD5HashFromFile(sfile);
                    }
                    else if (sfile.EndsWith(".idata"))
                    {
                    }
                    else
                    {
                    }
                }

                return(new VDBT(null, "Kavprot.VDBT.Malware/Unknown", th, dh, hash, "PES"));
            }
            else if (FileFormat.GetFileFormat(file).Name == "ARCHIVE-TYPE-SCANNER")
            {
                return(new VDBT(null, "Kavprot.VDBT.Malware/Unknown", null, null, Security.GetMD5HashFromFile(file), "ARS"));
            }
            else if (FileFormat.GetFileFormat(file).Name == "HASH-TYPE-SCANNER")
            {
                return(new VDBT(null, "Kavprot.VDBT.Malware/Unknown", null, null, Security.GetMD5HashFromFile(file), "HAS"));
            }
            else if (FileFormat.GetFileFormat(file).Name == "ASCII-TYPE-SCANNER")
            {
                string        hex = null;
                StringBuilder sb  = new StringBuilder();
                using (StreamReader sr = new StreamReader(file))
                {
                    hex = Security.DumpHex(sr, sb);
                }

                return(new VDBT(hex, "Kavprot.VDBT.MaliciousCode/Unknown", null, null, Security.GetMD5HashFromFile(file), "ASC"));
            }
            else
            {
                return(new VDBT(null, null, null, null, null, "NOS"));
            }
        }
예제 #2
0
        public void Quarantine()
        {
            try
            {
                if (Scanner == AVEngine.ArchiveTypeScanner)
                {
                    KCompress.KCompressExtractor extr = new KCompress.KCompressExtractor(Location);
                    extr.ExtractArchive(AVEngine.TempDir + @"QA\A\");

                    EncryptFile(AVEngine.TempDir + @"QA\A\" + FileName, Application.StartupPath + @"\Quarantine\" + Path.GetFileName(FileName) + ".KPQ", "ac1s8y9s");
                    File.WriteAllText(Application.StartupPath + @"\Quarantine\" + Path.GetFileName(FileName) + ".KPQI", FileName + "\r\n" + Name);
                    Q = true;
                    File.Delete(AVEngine.TempDir + @"QA\A\" + FileName);
                    File.Copy(Location, Application.StartupPath + @"\Quarantine\ARCHIVEBACKUP\" + Path.GetFileName(Location) + ".BACKUP");
                    KCompress.KCompressCompressor comp = new KCompress.KCompressCompressor();
                    comp.IncludeEmptyDirectories = true;
                    comp.FastCompression         = true;
                    comp.CompressionLevel        = KCompress.CompressionLevel.High;
                    comp.CompressionMethod       = KCompress.CompressionMethod.Default;
                    comp.CompressionMode         = KCompress.CompressionMode.Create;
                    comp.CompressDirectory(AVEngine.TempDir + @"QA\A\", Location);
                    Directory.Delete(AVEngine.TempDir + @"QA\A\", true);
                }
                else
                {
                    EncryptFile(Location, Application.StartupPath + @"\Quarantine\" + Path.GetFileName(Location) + ".KPQ", "ac1s8y9s");
                    File.WriteAllText(Application.StartupPath + @"\Quarantine\" + Path.GetFileName(Location) + ".KPQI", Location + "\r\n" + Name);
                    Q = true;
                    File.Delete(Location);
                }
            }
            catch (Exception ex)
            {
                if (Scanner == AVEngine.ArchiveTypeScanner && ex is KCompress.KCompressException)
                {
                    if (File.Exists(AVEngine.TempDir + @"QAB\" + Path.GetFileName(Location)))
                    {
                        File.Copy(AVEngine.TempDir + @"QAB\" + Path.GetFileName(Location), Location);
                    }
                }
            }
            finally
            {
            }
        }