die-python 0.1.0__cp38-cp38-win_amd64.whl

db/PE/virus-njrat-0.7d.7.sg

@@ -0,0 +1,136 @@
+// DIE's signature file
+// Author: DosX
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+
+    if (!PE.isNET()) return null;
+
+    if (!PE.isNetObjectPresent("Microsoft.VisualBasic")) return null;
+
+    const malwareType = "NjRAT";
+
+    if (checkForNative(
+            type = malwareType, edition = "0.7D Green Edition", stubReferences = [
+                "w",
+                "System.Drawing",
+                "System.Windows.Forms",
+                "avicap32.dll", "capGetDriverDescriptionA",
+                "kernel32",
+                "KERNEL32.DLL",
+                "ntdll",
+                "user32", "GetWindowText", "EnumChildWindows", "SendMessage", "GetWindowTextLength",
+                "user32.dll",
+                "winmm.dll"
+            ], objectsToValidate = ["A", "kl", "mgr", "OK"])) {
+        return null;
+    }
+
+    if (checkForNative(
+            type = malwareType, edition = "0.7D Lime Edition", stubReferences = [
+                "Stub",
+                "System.Drawing",
+                "System.Windows.Forms",
+                "avicap32.dll", "capGetDriverDescriptionA",
+                "kernel32",
+                "ntdll", "NtSetInformationProcess",
+                "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
+                "user32.dll",
+                "wintrust.dll"
+            ], objectsToValidate = ["Lime", "kl", "StartNow"])) {
+        return null;
+    }
+
+    if (checkForNative(
+            type = malwareType, edition = "0.7D", stubReferences = [
+                "Stub",
+                "System.Drawing",
+                "System.Windows.Forms",
+                "avicap32.dll", "capGetDriverDescriptionA",
+                "kernel32",
+                "ntdll", "NtSetInformationProcess",
+                "user32", "MapVirtualKey", "ToUnicodeEx", "GetKeyboardState",
+                "user32.dll"
+            ], objectsToValidate = ["A", "kl", "OK"])) {
+        return null;
+    }
+
+    if (checkForNative(
+            type = malwareType, edition = "0.7D Danger Edition", stubReferences = [
+                "Stub",
+                "System.Drawing",
+                "System.Windows.Forms",
+                "avicap32.dll", "capGetDriverDescriptionA",
+                "Kernel32.dll",
+                "KERNEL32.DLL",
+                "user32", "GetWindowText", "EnumChildWindows", "SendMessage", "GetWindowTextLength", "SetWindowPos",
+                "user32.dll",
+                "winmm.dll",
+            ], objectsToValidate = ["e", "A", "CompDir", "connect"])) {
+        return null;
+    }
+
+    if (checkForNative(
+            type = malwareType, edition = "0.7D Golden Edition", stubReferences = [
+                "Stub",
+                "System.Drawing",
+                "System.Windows.Forms",
+                "avicap32.dll",
+                "kernel32",
+                "Kernel32.dll",
+                "ntdll",
+                "user32", "GetWindowText",
+                "user32.dll",
+                "winmm.dll",
+            ], objectsToValidate = ["A", "OK", "connect"])) {
+        return null;
+    }
+
+    if (checkForNative(
+            type = "XWorm", edition = "5.0", stubReferences = [
+                "System.Core",
+                "System.Drawing",
+                "System.Management",
+                "System.Windows.Forms",
+                "avicap32.dll", "capCreateCaptureWindowA",
+                "kernel32.dll", "SetThreadExecutionState", "",
+                "user32.dll", "GetForegroundWindow", "GetWindowText",
+            ], objectsToValidate = ["Main", "ClientSocket", "Uninstaller"])) {
+        return null;
+    }
+}
+
+function checkForNative(type, edition, stubReferences, objectsToValidate) {
+    if (validateReferences(
+            isPositive = true,
+            references = stubReferences
+        )) {
+        return false;
+    }
+
+    var isObfuscated = false;
+    if (validateReferences(
+            isPositive = true,
+            references = objectsToValidate
+        )) {
+        isObfuscated = true;
+    }
+
+    _setResult("virus", type, edition, (isObfuscated ? "Obfuscated" : ""));
+    return true;
+}
+
+function validateReferences(isPositive, references) {
+    for (var i = 0; i < references.length; i++) {
+        var sign = "00'" + references[i] + "'00";
+        if (isPositive) {
+            if (!PE.isSignatureInSectionPresent(0, sign)) {
+                return true;
+            }
+        } else { // negative
+            if (PE.isSignatureInSectionPresent(0, sign)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}

db/PE/wxWidgets.5.sg

@@ -0,0 +1,27 @@
+// DIE's signature file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+init("library", "wxWidgets");
+
+includeScript("wxWidgets");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (aWx == 1) {
+        sOptions = "static";
+        bDetected = true;
+    } else if (aWx) {
+        sVersion = (aWx[2] / 10).toFixed(1);
+        if (aWx[1]) {
+            sOptions = "Universal";
+        }
+        if (aWx[3]) {
+            sOptions = sOptions.append("Unicode");
+        }
+        if (aWx[4]) {
+            sOptions = sOptions.append("debug");
+        }
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/yzPack.2.sg

@@ -0,0 +1,26 @@
+// DIE's signature file
+
+init("packer", "yzPack");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.compareEP("6033C08D480750E2FD8BEC648B4030780C8B400C")) {
+        sVersion = "1.0-1.1";
+        bDetected = true;
+    } else if (PE.compareEP("4D5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
+        sVersion = "1.2";
+        bDetected = true;
+    } else if (PE.compareEP("5A52456083EC188BEC8BFC33C0648B4030780C8B400C8B701CAD8B4008EB098B403483C07C8B403CABE9")) {
+        sVersion = "1.12";
+        bDetected = true;
+    } else if (PE.compareEP("25........6187CC5545455581EDCA00000055A4B302FF142473F833C9FF1424731833C0FF1424731FB3")) {
+        sVersion = "2.0";
+        bDetected = true;
+    }
+    /*else if(PE.isSignaturePresent(0,512,"'MZKERNEL32'")) // false detect  (Win)Upack
+    {
+        sVersion="2.0";
+        bDetected=1;
+    } */
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/zip.6.sg

@@ -0,0 +1,9 @@
+// DIE's signature file
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("zip-file");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    detect_Zip(0, bShowOptions);
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/PE/zlib.4.sg

@@ -0,0 +1,14 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+init("library", "zlib");
+
+function detect(bShowType, bShowVersion, bShowOptions) {
+    if (PE.isLibraryPresentExp(/^zlib*/)) {
+        bDetected = true;
+    }
+
+    return result(bShowType, bShowVersion, bShowOptions);
+}

db/QtFramework

@@ -0,0 +1,16 @@
+// Qt is tested twice - as a library and as a compiler (to distinguish C from
+// C++).  Detect it once here.
+// coauthor: sendersu
+
+var aQt;
+var ownName;
+if (typeof aQt === "undefined" && typeof PE !== "undefined") {
+    ownName = PE.getFileBaseName() + "." + PE.getFileCompleteSuffix();
+    aQt = PE.isLibraryPresentExp(/^Qt(\d)?Core(d?)(\d)?/i);
+    //special case - check own name
+    if (!aQt) {
+        aQt = ownName.match(/^Qt(\d)?Core(d?)(\d)?/i)
+        if (aQt)
+            aQt[0] = ownName;
+    }
+}

db/RosASM

@@ -0,0 +1,13 @@
+// RosASM's PE DOS stub is tested twice - once to detect RosASM as a compiler and
+// again to prevent being detected as a linker (RosASM has no linker).  Detect it
+// once here.
+
+var bRosASM;
+if (typeof bRosASM === "undefined") {
+    bRosASM = false;
+    if (PE.compare("'RosAsm Assembler'", 0xb0)) {
+        bRosASM = true;
+    } else if (PE.compare("'MZ'90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000000000000000........800000000e1fba0e00b409cd21b8014ccd21'This program cannot be run in DOS mode\r\n$'000000000000000000")) {
+        bRosASM = true;
+    }
+}

db/SpASM

@@ -0,0 +1,8 @@
+// SpASM's PE DOS stub is tested twice - once to detect SpASM as a compiler and
+// again to prevent being detected as a linker (SpASM has no linker).  Detect it
+// once here.
+
+var bSpASM;
+if (typeof bSpASM === "undefined") {
+    bSpASM = PE.compare("'MZ'80000000000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000007786c16800000000e1fba0e00b409cd21b8014ccd21'Spindoz 32 spit PEfile made wizz SpAsm Assembler.$'");
+}

db/ZIP/_init

@@ -0,0 +1,4 @@
+var File = ZIP;
+var X = ZIP;
+
+includeScript("result-general");

db/_init

@@ -0,0 +1,128 @@
+/**
+ * The type of the signature. For example <code>compiler</code> or <code>packer</code>.
+ */
+var sType;
+/**
+ * The name of the signature.
+ */
+var sName;
+/**
+ * The version of the signature.
+ */
+var sVersion;
+/**
+ * Options used by the signature.
+ */
+var sOptions;
+/**
+ * The flag to indicate the signature was found.
+ */
+var bDetected;
+
+/**
+ * Initialize a signature.
+ * @param {String} [sType="unknown"] - The signature type.
+ * @param {String} [sName="unknown"] - The signature name.
+ * @param {String} [sVersion=""] - The signature version.
+ * @param {String} [sOptions=""] - The signature options.
+ */
+function init() {
+    sType = arguments[0] ? arguments[0] : "unknown";
+    sName = arguments[1] ? arguments[1] : "unknown";
+    sVersion = arguments[2] ? arguments[2] : "";
+    sOptions = arguments[3] ? arguments[3] : "";
+    bDetected = false;
+}
+
+/**
+ * Append one or more strings.
+ * @param {...String} sString - String(s) to append.
+ * @returns {String} The new string.
+ * @global
+ * @example
+ * sOptions=sOptions.append("debug",string1);
+ */
+String.prototype.append = function() {
+    var s = this.valueOf();
+    var sep = ",";
+    if (arguments.length) {
+        if (s) s += sep;
+        s += arguments[0];
+        for (var i = 1; i < arguments.length; i++) {
+            s += sep + arguments[i];
+        }
+    }
+    return s;
+}
+
+/**
+ * Append a string with a custom separator.
+ * @param {String} sString - String to append.
+ * @param {String} [sSep=","] - Separator string.
+ * @returns {String} The new string.
+ * @global
+ * @example
+ * sOptions=sOptions.appendS("debug","::");
+ */
+String.prototype.appendS = function() {
+    var s = this.valueOf();
+    var sep = arguments[1] ? arguments[1] : ",";
+    if (arguments.length) {
+        if (s) s += sep;
+        s += arguments[0];
+    }
+    return s
+}
+
+String.prototype.addIfNone = function() {
+    var s = this.valueOf();
+    if (arguments.length)
+        if (s.indexOf(arguments[0]) < 0) s += arguments[0]
+    return s;
+}
+
+/**
+ * Pad the start of a line with spaces or the character given.
+ * This reimplements missing functionality of the more modern ECMAScript.
+ * @param {String or Number} The width desired.
+ * @param {Number} [nPad=" "] The padding string. Loops.
+ * @returns {String} The new string.
+ * @global
+ * @example
+ * var a = 12; ...; if("aba12" === a.padStart(5,"ab")) ...
+ */
+String.prototype.padStart = function() {
+    var s = this.valueOf();
+    if (!s.length || !arguments.length || s.length <= arguments[0].length) return s;
+    var c = 0,
+        p = ' ';
+    if (arguments.length > 1) p = arguments[1].toString();
+    var pp = "";
+    for (var i = 0; i < Math.max(0, arguments[0] - s.length); i++) {
+        pp += p[c];
+        c++;
+        if (c === p.length) c = 0
+    }
+    return pp + s
+}
+
+Number.prototype.padStart = function() {
+    var s = this.valueOf().toString();
+    if (!arguments.length || s.length >= arguments[0]) return s;
+    var c = 0,
+        p = ' ';
+    if (arguments.length > 1) p = arguments[1].toString();
+    var pp = "";
+    for (var i = 0; i < Math.max(0, arguments[0] - s.length); i++) {
+        pp += p[c];
+        c++;
+        if (c === p.length) c = 0
+    }
+    return pp + s
+}
+
+function debug(messageText) {
+    _setResult("debug", messageText, "", "");
+}
+
+includeScript("language");

db/archive-file

@@ -0,0 +1,36 @@
+// Common routines for handling archives.
+
+init("archive");
+
+var Archive = {
+    nFiles: 0, // number of files in archive
+    nDirs: 0, // number of directories in archive
+    nSize: 0, // total unpacked size of all files
+    nPacked: 0, // total packed size of all files
+
+    // Add an entry, updating the counts and sizes.
+    add: function(nSize, nPacked, bDir) {
+        if (bDir) {
+            this.nDirs++;
+        } else {
+            this.nFiles++;
+            this.nSize += nSize;
+            this.nPacked += nPacked;
+        }
+    },
+
+    // Return the contents according to what was found - "P%,F files,D dirs".
+    contents: function() {
+        var sContents = "";
+        if (this.nSize != 0) {
+            sContents = (this.nPacked / this.nSize * 100).toFixed(1) + "%";
+        }
+        if (this.nFiles != 0) {
+            sContents = sContents.append(this.nFiles + (this.nFiles == 1 ? " file" : " files"));
+        }
+        if (this.nDirs != 0) {
+            sContents = sContents.append(this.nDirs + (this.nDirs == 1 ? " dir" : " dirs"));
+        }
+        return sContents;
+    }
+}

db/arj

@@ -0,0 +1,80 @@
+// Detect an ARJ archive.
+// Info from http://www.fileformat.info/format/arj/corion.htm
+includeScript("archive-file");
+sName = "ARJ";
+
+function detect_ARJ(bFile, bShowOptions) {
+    var nOffset, nSize;
+    if (bFile) {
+        nOffset = 0;
+        nSize = File.getSize();
+    } else {
+        nOffset = File.getOverlayOffset() + 8;
+        nSize = File.getOverlaySize();
+    }
+    if (nSize >= 64) {
+        if (File.compare("60EA", nOffset)) {
+            sVersion = File.readByte(nOffset + 5);
+            bDetected = 1;
+        }
+        if (bDetected && bShowOptions) {
+            // Options
+            switch (File.readByte(nOffset + 7)) // Host OS
+            {
+                case (0):
+                    sOptions = sOptions.append("MS-DOS");
+                    break;
+                case (1):
+                    sOptions = sOptions.append("PRIMOS");
+                    break;
+                case (2):
+                    sOptions = sOptions.append("UNIX");
+                    break;
+                case (3):
+                    sOptions = sOptions.append("AMIGA");
+                    break;
+                case (4):
+                    sOptions = sOptions.append("MAC-OS");
+                    break;
+                case (5):
+                    sOptions = sOptions.append("OS/2");
+                    break;
+                case (6):
+                    sOptions = sOptions.append("APPLE GS");
+                    break;
+                case (7):
+                    sOptions = sOptions.append("ATARI ST");
+                    break;
+                case (8):
+                    sOptions = sOptions.append("NeXT");
+                    break;
+                case (9):
+                    sOptions = sOptions.append("VAX VMS");
+                    break;
+            }
+            if (File.readByte(nOffset + 8) & 0x01) // password
+            {
+                sOptions = sOptions.append("encrypted");
+            }
+
+            switch (File.readByte(nOffset + 9)) // Compression method
+            {
+                case (0):
+                    sOptions = sOptions.append("stored");
+                    break;
+                case (1):
+                    sOptions = sOptions.append("compressed most");
+                    break;
+                case (2):
+                    sOptions = sOptions.append("compressed");
+                    break;
+                case (3):
+                    sOptions = sOptions.append("compressed faster");
+                    break;
+                case (4):
+                    sOptions = sOptions.append("compressed fastest");
+                    break;
+            }
+        }
+    }
+}

db/cab

@@ -0,0 +1,46 @@
+// Detect a Cab archive.
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+includeScript("archive-file");
+sName = "Microsoft Cabinet File";
+
+function detect_Cab(nOffset, nSize, bShowOptions) {
+    if (nSize > 48) {
+        if (File.compare("'MSCF'00000000", nOffset)) {
+            bDetected = true;
+            sVersion = File.readByte(nOffset + 0x19) + ".0" + File.readByte(nOffset + 0x18);
+            var nFilesOffset = nOffset + File.readDword(nOffset + 0x10);
+            var nFiles = File.readWord(nOffset + 0x1C);
+            var nPacked = File.readDword(nOffset + 8);
+            if (File.readByte(nOffset + 0x1E) & 4) {
+                nOffset += File.readDword(nOffset + 0x24) + 4;
+            }
+            switch (File.readByte(nOffset + 0x2A) & 15) {
+                case 1:
+                    sOptions = sOptions.append("MSZip");
+                    break;
+                case 2:
+                    sOptions = sOptions.append("Quantum");
+                    break;
+                case 3:
+                    sOptions = sOptions.append("LZX");
+                    break;
+            }
+            if (bShowOptions) {
+                // Packed size is not stored directly, so assume the first
+                // folder's data is first and just skip the names.
+                nPacked -= File.readDword(nOffset + 0x24);
+                while (nFiles--) {
+                    Archive.add(File.readDword(nFilesOffset), nPacked,
+                        File.readByte(nFilesOffset + 14) & 16);
+                    nFilesOffset = File.findByte(nFilesOffset + 16, 256, 0) + 1;
+                    nPacked = 0;
+                }
+                sOptions = sOptions.append(Archive.contents());
+            }
+            return 1;
+        }
+    }
+
+    return 0;
+}

db/duration

@@ -0,0 +1,14 @@
+// Convert a time in seconds to a string:
+//    less than 10 seconds: N.NNs
+//    less than a minute: NN.Ns
+//    otherwise: NmNNs
+// Author: Jason Hood <jadoxa@yahoo.com.au>
+
+function duration(nSeconds) {
+    if (nSeconds < 60) {
+        return nSeconds.toFixed(nSeconds < 10 ? 2 : 1) + "s";
+    }
+    nSeconds = Math.round(nSeconds);
+    return Math.floor(nSeconds / 60) + "m" +
+        ("0" + Math.floor(nSeconds % 60)).slice(-2) + "s";
+}

db/language

@@ -0,0 +1,33 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+function _isLangPresent(languageName) {
+    return _isResultPresent("language", languageName) || _isResultPresent("~language", languageName);
+}
+
+function _isLangDetected() {
+    return _getNumberOfResults("language") || _getNumberOfResults("~language");
+}
+
+function _setLang(languageName, isPositive, version) {
+    if (isPositive == true || isPositive == undefined) {
+        // if "C/C++" already detected
+        if (_isLangPresent("C/C++") && (languageName == "C" || languageName == "C++")) {
+            _removeResult("language", "C/C++");
+        }
+
+        // if "C" or "C++"" detected
+        if (languageName == "C/C++" && (_isLangPresent("C") || _isLangPresent("C++"))) {
+            return null;
+        }
+
+        if (File.isVerbose() && !_isLangPresent(languageName)) {
+            var isHeurResult = (version == "HEUR");
+
+            _setResult((isHeurResult ? "~" : "") + "language", languageName, (version && !isHeurResult ? version : ""), "", "");
+        }
+    }
+
+}

db/python

@@ -0,0 +1,30 @@
+// Author: DosX
+// E-Mail: collab@kay-software.ru
+// GitHub: https://github.com/DosX-dev
+// Telegram: @DosX_dev
+
+function getPythonVersionByDll(dllFileName) { // python = 💩
+    var version = "";
+
+    var startIndex = dllFileName.indexOf("python");
+    if (startIndex !== -1) {
+        startIndex += 6;
+        var endIndex = dllFileName.indexOf(".", startIndex);
+        if (endIndex === -1) {
+            endIndex = dllFileName.length;
+        }
+        version = dllFileName.substring(startIndex, endIndex);
+    }
+
+    if (version !== "") {
+        if (version.length === 1) {
+            return version + ".0";
+        } else if (version.length === 2) {
+            return version[0] + "." + version[1];
+        } else {
+            return version[0] + "." + version.substring(1);
+        }
+    } else {
+        return null;
+    }
+}