(self)
| 323 | self.warnings.append(f"Quarantine Failed: {e}") |
| 324 | |
| 325 | def run(self): |
| 326 | # Size Check: Only if strictly greater than limit, but we set limit to 50GB |
| 327 | if self.size > MAX_FILE_SIZE_LIMIT: |
| 328 | console.print(f"[red]Skipping {self.filename}: Too massive (>50GB)[/]") |
| 329 | return |
| 330 | |
| 331 | sha256 = self.get_hashes() |
| 332 | console.print(f"[cyan]>> Analyzing {escape(self.filename)}...[/cyan]") |
| 333 | |
| 334 | self.check_virustotal(sha256) |
| 335 | mime, desc = get_file_mime(self.filepath, self.data) |
| 336 | entropy = self.calculate_entropy() |
| 337 | |
| 338 | if entropy > 7.4 and "zip" not in mime and "image" not in mime: |
| 339 | self.warnings.append(f"High Entropy ({entropy:.2f}): Likely Packed/Encrypted payload.") |
| 340 | self.risk_score += 3 |
| 341 | |
| 342 | # Run Modules |
| 343 | self.analyze_metadata() |
| 344 | self.analyze_steganography_overlay(mime) |
| 345 | self.analyze_archives() |
| 346 | self.analyze_strings() |
| 347 | self.analyze_pdf_structure() |
| 348 | self.analyze_office_macros() |
| 349 | self.analyze_pe_header() |
| 350 | |
| 351 | if any(x in mime for x in ["dosexec", "executable", "x-elf"]): |
| 352 | self.risk_score += 5 |
| 353 | self.warnings.append(f"File is an Executable Binary ({mime})") |
| 354 | |
| 355 | if re.search(r'\.(exe|bat|sh|vbs|apk)\.[a-z]{3}$', self.filename.lower()): |
| 356 | self.risk_score += 8 |
| 357 | self.warnings.append("Double Extension Spoofing Detected") |
| 358 | |
| 359 | if self.risk_score >= QUARANTINE_THRESHOLD: |
| 360 | self.quarantine_file() |
| 361 | |
| 362 | self.print_report(sha256, mime, desc, entropy) |
| 363 | |
| 364 | def print_report(self, sha256, mime, desc, entropy): |
| 365 | if self.risk_score >= 7: |
no test coverage detected