malware_analysis_tool.go

package main

import (
	"archive/zip"
	"bufio"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"io/ioutil"
	"math"
	"os"
	"path/filepath"
	"strings"
)

// Constants for analysis thresholds
const (
	highEntropyThreshold = 7.5    // Adjust this value based on your needs
	suspiciousKeyword    = "exec" // Example of a suspicious keyword
)

// Main function to run the tool
func main() {
	if len(os.Args) < 2 {
		fmt.Println("Usage: go run malware_analysis_tool.go <path_to_file>")
		return
	}

	filePath := os.Args[1]
	fileType := detectFileType(filePath)

	fmt.Println("Analyzing file:", filePath)

	switch fileType {
	case "PE":
		analyzePE(filePath)
	case "ELF":
		analyzeELF(filePath)
	case "JAR":
		analyzeJAR(filePath)
	case "script":
		analyzeScript(filePath)
	case "Office":
		analyzeOffice(filePath)
	default:
		fmt.Println("Unsupported file type or file is not a recognized executable.")
	}
}

// Function to detect the file type based on extension
func detectFileType(filePath string) string {
	ext := strings.ToLower(filepath.Ext(filePath))
	switch ext {
	case ".exe":
		return "PE"
	case ".elf":
		return "ELF"
	case ".jar":
		return "JAR"
	case ".py", ".sh", ".js":
		return "script"
	case ".docx", ".xlsx":
		return "Office"
	default:
		return "unknown"
	}
}

// Analyze PE files
func analyzePE(filePath string) {
	fmt.Println("Analyzing PE file:", filePath)
	// Implement your PE file analysis logic here
	// For now, we'll just calculate its entropy
	calculateEntropy(filePath)
}

// Analyze ELF files
func analyzeELF(filePath string) {
	fmt.Println("Analyzing ELF file:", filePath)
	// Implement your ELF file analysis logic here
	// For now, we'll just calculate its entropy
	calculateEntropy(filePath)
}

// Analyze JAR files
func analyzeJAR(filePath string) {
	fmt.Println("Analyzing JAR file:", filePath)

	// Extract and analyze contents of JAR
	file, err := zip.OpenReader(filePath)
	if err != nil {
		fmt.Println("Error opening JAR file:", err)
		return
	}
	defer file.Close()

	fmt.Println("Contents of the JAR file:")
	for _, f := range file.File {
		fmt.Println(" -", f.Name)
		// Further analysis can be done on the extracted files
	}
}

// Analyze script files
func analyzeScript(filePath string) {
	fmt.Println("Analyzing script file:", filePath)

	file, err := os.Open(filePath)
	if err != nil {
		fmt.Println("Error opening script file:", err)
		return
	}
	defer file.Close()

	scanner := bufio.NewScanner(file)
	suspiciousFound := false
	for scanner.Scan() {
		line := scanner.Text()
		if strings.Contains(line, suspiciousKeyword) || strings.Contains(line, "os.system") {
			fmt.Println("Suspicious command found:", line)
			suspiciousFound = true
		}
	}

	if err := scanner.Err(); err != nil {
		fmt.Println("Error reading script file:", err)
	}

	// Calculate entropy
	entropy := calculateEntropy(filePath)

	// Check if the file is malicious based on entropy and suspicious commands
	if suspiciousFound || entropy > highEntropyThreshold {
		fmt.Println("The script file may be malicious.")
	} else {
		fmt.Println("The script file appears to be safe.")
	}
}

// Analyze Office files
func analyzeOffice(filePath string) {
	fmt.Println("Analyzing Office file:", filePath)
	// This is a placeholder; implement analysis of Office documents
	fmt.Println("Office file analysis is not implemented yet.")
}

// Calculate entropy of a file
func calculateEntropy(filePath string) float64 {
	data, err := ioutil.ReadFile(filePath)
	if err != nil {
		fmt.Println("Error reading file:", err)
		return 0
	}

	freq := make(map[byte]int)
	for _, b := range data {
		freq[b]++
	}

	var entropy float64
	length := float64(len(data))

	for _, count := range freq {
		p := float64(count) / length
		if p > 0 {
			entropy -= p * math.Log2(p)
		}
	}

	fmt.Printf("Entropy of the file: %.2f\n", entropy)

	// Additional feature: calculate SHA-256 hash of the file
	hash := computeSHA256(filePath)
	fmt.Println("SHA-256 Hash of the file:", hash)

	// Additional feature: check file size
	fileInfo, err := os.Stat(filePath)
	if err == nil {
		fmt.Println("File size (bytes):", fileInfo.Size())
	} else {
		fmt.Println("Error getting file size:", err)
	}

	return entropy
}

// Function to compute SHA-256 hash of a file
func computeSHA256(filePath string) string {
	data, err := ioutil.ReadFile(filePath)
	if err != nil {
		return ""
	}
	hash := sha256.Sum256(data)
	return hex.EncodeToString(hash[:])
}