mirror of
https://github.com/hasherezade/pe-sieve
synced 2026-06-08 14:34:52 +00:00
hasherezade
34 lines
945 B
C++
34 lines
945 B
C++
#include "stats_analyzer.h"
|
|
|
|
#define ENTROPY_CODE_TRESHOLD 1.5
|
|
#define ENTROPY_ENC_TRESHOLD 6.0
|
|
|
|
using namespace pesieve::util;
|
|
|
|
bool pesieve::util::isSuspicious(IN const AreaStats<BYTE>& stats, OUT AreaInfo& info)
|
|
{
|
|
if (!stats.isFilled()) {
|
|
return false;
|
|
}
|
|
|
|
const BYTE mFreqVal = util::getMostFrequentValue<BYTE>(stats.currArea.histogram);
|
|
double entropy = stats.currArea.entropy;
|
|
|
|
info.fullAreaObfuscated = (mFreqVal != 0 && entropy > ENTROPY_CODE_TRESHOLD); // possible XOR obfuscation, or block cipher
|
|
info.fullAreaEncrypted = entropy > ENTROPY_ENC_TRESHOLD; // strong encryption
|
|
/*
|
|
for (auto itr = stats.chunks.begin(); itr != stats.chunks.end(); itr++) {
|
|
const ChunkStats<BYTE> chunk = *itr;
|
|
if (chunk.entropy > ENTROPY_ENC_TRESHOLD) {
|
|
info.containsEncryptedBlocks = true;
|
|
break;
|
|
|
|
}
|
|
}
|
|
*/
|
|
const bool isEnc = (info.fullAreaEncrypted) ||
|
|
(info.fullAreaObfuscated && info.containsEncryptedBlocks);
|
|
|
|
return isEnc;
|
|
}
|