Function FileAnalysis

analysis.go:25–91

FileAnalysis sub-routine for file analysis (used in registry / task scheduler / startmenu scan)

(path string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string)

// FileAnalysis sub-routine for file analysis (used in registry / task scheduler / startmenu scan)
func FileAnalysis(path string, pQuarantine string, pKill bool, pNotifications bool, pVerbose bool, rules *yara.Rules, sourceIndex string) {
	var f os.FileInfo
	var err error
	var content []byte
	var result yara.MatchRules

	if f, err = os.Stat(path); err != nil {
		if pVerbose {
			logMessage(LOG_ERROR, "[ERROR]", path, err)
		}
	} else {
		if RegisterFileInHistory(f, path, &filescanHistory, pVerbose) {

			content, err = os.ReadFile(path)
			if err != nil && pVerbose {
				logMessage(LOG_ERROR, "[ERROR]", path, err)
			}

			filetype, err := filetype.Match(content)
			if err != nil && pVerbose {
				logMessage(LOG_ERROR, "[ERROR]", path, err)
			}

			if pVerbose {
				logMessage(LOG_INFO, "[INFO] ["+sourceIndex+"] Analyzing", path, fmt.Sprintf("%x", md5.Sum(content)))
			}

			// cleaning memory if file size is greater than 512Mb
			if len(content) > 1024*1024*cleanIfFileSizeGreaterThan {
				defer debug.FreeOSMemory()
			}

			// archive or other file format scan
			if StringInSlice(filetype.MIME.Value, archivesFormats) {
				result = PerformArchiveYaraScan(path, rules, pVerbose)
			} else {
				result = PerformYaraScan(&content, rules, pVerbose)
			}

			if len(result) > 0 {
				// windows notifications
				if pNotifications {
					NotifyUser("YARA match", path+" match "+fmt.Sprint(len(result))+" rules")
				}

				// logging
				for _, match := range result {
					logMessage(LOG_INFO, "[ALERT]", "["+sourceIndex+"] YARA match", path, match.Namespace, match.Rule)
				}

				// kill
				if pKill {
					killQueue = append(killQueue, path)
				}

				// dump matching file to quarantine
				if len(pQuarantine) > 0 {
					logMessage(LOG_INFO, "[INFO]", "Dumping file", path)