hostr/lib/malware.js

import virustotal from 'virustotal.js';

virustotal.setKey(process.env.VIRUSTOTAL_KEY);

const extensions = ['EXE', 'PIF', 'APPLICATION', 'GADGET', 'MSI', 'MSP', 'COM', 'SCR', 'HTA', 'CPL', 'MSC',
  'JAR', 'BAT', 'CMD', 'VB', 'VBS', 'VBE', 'JS', 'JSE', 'WS', 'WSF', 'WSC', 'WSH', 'PS1', 'PS1XML', 'PS2',
  'PS2XML', 'PSC1', 'PSC2', 'MSH', 'MSH1', 'MSH2', 'MSHXML', 'MSH1XML', 'MSH2XML', 'SCF', 'LNK', 'INF', 'REG',
  'PDF', 'DOC', 'XLS', 'PPT', 'DOCM', 'DOTM', 'XLSM', 'XLTM', 'XLAM', 'PPTM', 'POTM', 'PPAM', 'PPSM', 'SLDM',
  'RAR', 'TAR', 'ZIP', 'GZ',
];

function getExtension(filename) {
  const i = filename.lastIndexOf('.');
  return (i < 0) ? '' : filename.substr(i + 1);
}

export default function(file) {
  return new Promise((resolve, reject) => {
    if (extensions.indexOf(getExtension(file.file_name.toUpperCase())) >= 0) {
      virustotal.getFileReport(file.md5, (err, res) => {
        if (err) {
          return reject(err);
        }
        if (res.scans) {
          resolve({positive: res.positives >= 5, result: res});
        } else {
          resolve();
        }
      });
    } else {
      resolve();
    }
  });
}