hostr/lib/malware.js
2018-06-02 18:20:05 +00:00

77 lines
985 B
JavaScript

import getFileReport from './virustotal';
const extensions = [
'EXE',
'PIF',
'APPLICATION',
'GADGET',
'MSI',
'MSP',
'COM',
'SCR',
'HTA',
'CPL',
'MSC',
'JAR',
'BAT',
'CMD',
'VB',
'VBS',
'VBE',
'JS',
'JSE',
'WS',
'WSF',
'WSC',
'WSH',
'PS1',
'PS1XML',
'PS2',
'PS2XML',
'PSC1',
'PSC2',
'MSH',
'MSH1',
'MSH2',
'MSHXML',
'MSH1XML',
'MSH2XML',
'SCF',
'LNK',
'INF',
'REG',
'PDF',
'DOC',
'XLS',
'PPT',
'DOCM',
'DOTM',
'XLSM',
'XLTM',
'XLAM',
'PPTM',
'POTM',
'PPAM',
'PPSM',
'SLDM',
'RAR',
'TAR',
'ZIP',
'GZ',
];
function getExtension(filename) {
const i = filename.lastIndexOf('.');
return (i < 0) ? '' : filename.substr(i + 1);
}
export default async (file) => {
if (extensions.indexOf(getExtension(file.name.toUpperCase())) < 0) {
return false;
}
const result = await getFileReport(file.md5);
return {
positive: result.positives >= 5,
result,
};
};