hostr/lib/malware.js
2015-08-03 22:06:40 +01:00

38 lines
1.3 KiB
JavaScript

import virustotal from 'virustotal.js';
virustotal.setKey(process.env.VIRUSTOTAL);
const extensions = ['EXE', 'PIF', 'APPLICATION', 'GADGET', 'MSI', 'MSP', 'COM', 'SCR', 'HTA', 'CPL', 'MSC',
'JAR', 'BAT', 'CMD', 'VB', 'VBS', 'VBE', 'JS', 'JSE', 'WS', 'WSF', 'WSC', 'WSH', 'PS1', 'PS1XML', 'PS2',
'PS2XML', 'PSC1', 'PSC2', 'MSH', 'MSH1', 'MSH2', 'MSHXML', 'MSH1XML', 'MSH2XML', 'SCF', 'LNK', 'INF', 'REG',
'PDF', 'DOC', 'XLS', 'PPT', 'DOCM', 'DOTM', 'XLSM', 'XLTM', 'XLAM', 'PPTM', 'POTM', 'PPAM', 'PPSM', 'SLDM',
'RAR', 'TAR', 'ZIP', 'GZ'
];
function getExtension(filename) {
const i = filename.lastIndexOf('.');
return (i < 0) ? '' : filename.substr(i + 1);
};
export default function (file) {
const deferred = {};
deferred.promise = new Promise(function(resolve, reject) {
deferred.resolve = resolve;
deferred.reject = reject;
});
if (extensions.indexOf(getExtension(file.file_name.toUpperCase())) >= 0) {
virustotal.getFileReport(file.md5, function (err, res) {
if (err) {
return deferred.reject(err);
}
if (res.scans) {
deferred.resolve({positive: res.positives >= 5, result: res});
} else {
deferred.resolve();
}
});
} else {
deferred.resolve();
}
return deferred.promise;
};