analyze_scripts.py

import re
import requests

import base64
import os
from fernet import Fernet
from uuid import uuid4
import json

show_lines = False
open_links = False
disable_fernet = True # only enable if you are fine with eval being used.

# import regex
# should detect any imports in the script, should return the imports and should end if a semicolon is detected
import_regex = re.compile(r"import\s+([a-zA-Z0-9_]+)")

# detect texts in quotes
# should detect any texts in quotes, single quotes and double quotes, should return the texts in quotes and should end if a semicolon is detected
text_in_quotes_regex = re.compile(r"['\"](.*?)['\"]")

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
}

BLACKLISTED_DOMAINS = [
    "microsoft.com",
    "7-zip.org",
]

def scan_line(lines):
    global show_lines
    extra_data = []
    texts = text_in_quotes_regex.findall(lines)
    imports = import_regex.findall(lines)
    if not imports and not texts:
        return
    
    if show_lines:
        if imports: print(f"Imports: {imports}")
        if texts: print(f"Texts: {texts}")

    for line in lines.splitlines():
        texts = text_in_quotes_regex.findall(line)

        for text in texts:
            if text.startswith("https://") and not any([x in text for x in BLACKLISTED_DOMAINS]):
                extra_data.append({
                    "type": "url",
                    "data": text
                })
            
                print(f"Detected URL: {text}")
                if ".exe" in text:
                    print(f"DANGER: Detected .exe in URL, proceed with caution. {text}")
                
                if open_links and ".exe" not in text:
                    try:
                        response = requests.get(text)

                        if response.status_code == 200:
                            extra_data.append({
                                "type": "opened link",
                                "data": scan_line(response.text),
                                "URL": text
                            })
                        else:
                            print("Failed to open link.")
                            extra_data.append({
                                "type": "error",
                                "data": f"Error: {response.status_code}",
                                "URL": text
                            })
                    except:
                        print("Failed to open link.")
                        extra_data.append({
                            "type": "error",
                            "data": "Failed to open link.",
                            "URL": text
                        })

        if "Fernet" in imports and not disable_fernet:
            print("Detected Fernet.")
            juicy_texts = []
            for text in texts:
                if any([x in text for x in ["=", "-", "_"]]) and len(text) > 10:
                    juicy_texts.append(text)

            if len(juicy_texts) < 2:
                print("Not enough juicy texts.")
                continue

            decrypted = eval(f"Fernet(b'{juicy_texts[0]}').decrypt(b'{juicy_texts[1]}')")

            if show_lines:
                print(decrypted)

            if "https" in decrypted.decode() and not any([x in text for x in BLACKLISTED_DOMAINS]):
                print("Detected URL in Fernet.")
                links = text_in_quotes_regex.findall(decrypted.decode())
                mal_url = None
                for link in links:
                    if link.startswith("http://") or link.startswith("https://") and not any([x in text for x in BLACKLISTED_DOMAINS]):
                        mal_url = link

                if mal_url is None:
                    print("No URL found in Fernet.")
                    continue

                if open_links:
                    try:
                        d = requests.get(mal_url)
                        if d.status_code == 200:
                            extra_data.append({
                                "type": "opened link",
                                "data": scan_line(d.text),
                                "URL": mal_url
                            })
                        else:
                            print("Failed to open link.")
                            extra_data.append({
                                "type": "error",
                                "data": f"Error: {d.status_code}",
                                "URL": decrypted.decode()
                            })
                    except:
                        print("Failed to open link.")
                        extra_data.append({
                            "type": "error",
                            "data": "Failed to open link.",
                            "URL": mal_url
                        })

            extra_data.append({
                "type": "Fernet",
                "data": scan_line(decrypted.decode()),
                "information": decrypted.decode()
            })

        if "base64" in imports:
            print("Detected Base64.")
            for text in texts:
                if len(text) > 15:
                    if show_lines:
                        print(base64.b64decode(text).decode())
                    extra_data.append({
                        "type": "base64",
                        "data": scan_line(base64.b64decode(text).decode()),
                        "information": base64.b64decode(text).decode()
                    })

                    links = text_in_quotes_regex.findall(base64.b64decode(text).decode())
                    mal_url = None
                    if links:
                        for link in links:
                            if link.startswith("http://") or link.startswith("https://") and not any([x in text for x in BLACKLISTED_DOMAINS]):
                                mal_url = link

                    if mal_url is None:
                        print("No URL found in Base64.")
                        continue

                    if open_links:
                        try:
                            d = requests.get(mal_url)
                            if d.status_code == 200:
                                extra_data.append({
                                    "type": "opened link",
                                    "data": scan_line(d.text),
                                    "URL": mal_url
                                })
                                print(d.text)
                            else:
                                print("Failed to open link.")
                                extra_data.append({
                                    "type": "error",
                                    "data": f"Error: {d.status_code}",
                                    "URL": mal_url
                                })     
                        except:
                            print("Failed to open link.")
                            extra_data.append({
                                "type": "error",
                                "data": "Failed to open link.",
                                "URL": mal_url
                            })     

    return extra_data

with open("./data.json", "w") as f:
    json.dump({}, f)

with open("./detections/detected_scripts.txt", "r") as f:
    for line in f.readlines():
        line_id = uuid4()

        extra_data = scan_line(line)
        with open("./data.json", "r") as f:
            data = json.load(f)

        data[str(line_id)] = extra_data
        with open("./data.json", "w") as f:
            json.dump(data, f, indent=4)

        print(f"Line ID: {line_id} dumped")