gds-domingues / malware-analysis

A simple Malware analysis for metadata, hash and traffic analysis

Malware-Analysis

A simple Malware analysis for metadata, hash, traffic analysis

Caution: do not execute the code in an environment without malware control, it runs it for dynamic analysis and it must be executed in a controlled laboratory to avoid damaging your device.

import os
import hashlib
import subprocess
import socket

These lines import necessary modules for the script: os for interacting with the operating system, hashlib for calculating hash values, subprocess for executing external commands, and socket for network-related operations.

Directory where malware samples are stored
MALWARE_SAMPLES_DIR = "malware_samples"

Defines the directory path where malware samples are stored. You should replace "malware_samples" with the actual path where your malware samples are located.

ef get_file_metadata(file_path):
    """
    Get metadata information of the file.
    """

Defines a function get_file_metadata() to retrieve metadata information of a file specified by its path. This function uses the os.stat() function to get file statistics such as size, creation time, last access time, and last modified time.

def calculate_hash(file_path):
    """
    Calculate hash values (MD5, SHA1, SHA256) of the file.
    """

Defines a function calculate_hash() to calculate hash values (MD5, SHA1, SHA256) of a file specified by its path. This function reads the file content in binary mode and calculates the hash values using the hashlib module.

def analyze_file(file_path):
    """
    Analyze the file for suspicious characteristics.
    """

Defines a function analyze_file() to analyze a file specified by its path for suspicious characteristics. This function calls get_file_metadata() and calculate_hash() to retrieve file metadata and hash values, and then checks for suspicious characteristics based on file extension and other criteria.

def execute_malware(file_path):
    """
    Execute the malware in a sandboxed environment.
    """

Defines a function execute_malware() to execute a malware sample specified by its path in a sandboxed environment. This function attempts to run the malware using an external command (a placeholder command sandbox_command) with a timeout of 60 seconds.

def capture_network_traffic():
    """
    Capture network traffic using tcpdump.
    """

Defines a function capture_network_traffic() to capture network traffic using tcpdump. This function runs tcpdump with specific parameters (-i for interface and -w to write output to a file) to capture network traffic and save it to a file named "malware_traffic.pcap".

if __name__ == "__main__"

Checks if the script is being run as the main program. # Path to the malware sample file malware_sample_path = os.path.join(MALWARE_SAMPLES_DIR, "spotify.exe")

Constructs the full path to the malware sample file (spotify.exe) by joining the directory path (MALWARE_SAMPLES_DIR) with the filename.

if os.path.isfile(malware_sample_path):

Checks if the malware sample file exists.

# Analyze the malware sample
        metadata, hash_values, suspicious_characteristics = analyze_file(malware_sample_path)

Calls the analyze_file() function to analyze the malware sample and stores the returned metadata, hash values, and suspicious characteristics.

        # Print file metadata
        print("\\nFile Metadata:")
        for key, value in metadata.items():
            print(f"{key}: {value}")

Prints the file metadata retrieved from the analyze_file() function.

        # Print hash values
        print("\\nHash Values:")
        for key, value in hash_values.items():
            print(f"{key}: {value}")

Prints the hash values retrieved from the analyze_file() function.

        # Print suspicious characteristics
        print("\\nSuspicious Characteristics:")
        if suspicious_characteristics:
            for characteristic in suspicious_characteristics:
                print(characteristic)
        else:
            print("No suspicious characteristics found.")

Prints the suspicious characteristics retrieved from the analyze_file() function, if any.

# Execute the malware in a sandboxed environment
        execute_malware(malware_sample_path

Calls the execute_malware() function to execute the malware sample in a sandboxed environment.

 # Capture network traffic generated by the malware
        capture_network_traffic()

Calls the capture_network_traffic() function to capture network traffic generated by the malware sample.

else:
        print("Malware sample not found.")

Prints a message if the malware sample file is not found.

This code is designed to analyze a malware sample, print its metadata, hash values, and suspicious characteristics, execute it in a sandboxed environment, and capture network traffic generated by the malware. It's important to exercise caution when working with malware samples, preferably in a controlled environment.