"""Identify cryptographic functions in ransomware PE files."""
import pefile
import sys
CRYPTO_APIS = {
"CryptAcquireContextA": "CryptoAPI context acquisition",
"CryptAcquireContextW": "CryptoAPI context acquisition",
"CryptGenKey": "Key generation",
"CryptDeriveKey": "Key derivation",
"CryptEncrypt": "Encryption operation",
"CryptDecrypt": "Decryption operation",
"CryptImportKey": "Key import (public key?)",
"CryptExportKey": "Key export",
"CryptGenRandom": "Random number generation",
"CryptCreateHash": "Hash creation",
"CryptHashData": "Hashing operation",
"BCryptOpenAlgorithmProvider": "CNG algorithm initialization",
"BCryptGenerateSymmetricKey": "CNG symmetric key generation",
"BCryptEncrypt": "CNG encryption",
"BCryptDecrypt": "CNG decryption",
"BCryptGenerateKeyPair": "CNG key pair generation",
"BCryptImportKeyPair": "CNG key import",
"EVP_EncryptInit_ex": "OpenSSL encrypt init",
"EVP_EncryptUpdate": "OpenSSL encrypt update",
"EVP_EncryptFinal_ex": "OpenSSL encrypt final",
"RSA_public_encrypt": "OpenSSL RSA encryption",
"AES_set_encrypt_key": "OpenSSL AES key setup",
"CreateFileW": "File open (target files)",
"ReadFile": "File read (before encryption)",
"WriteFile": "File write (after encryption)",
"FindFirstFileW": "File enumeration (targeting)",
"FindNextFileW": "File enumeration",
"MoveFileW": "File rename (extension change)",
"DeleteFileW": "File deletion (originals)",
}
AES_SBOX = bytes([
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5,
0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
])
CHACHA20_CONSTANT = b"expand 32-byte k"
def analyze_imports(filepath):
"""Analyze PE imports for cryptographic APIs."""
try:
pe = pefile.PE(filepath)
except pefile.PEFormatError:
print("[-] Not a valid PE file")
return
print("[+] Cryptographic API Analysis")
print("=" * 60)
crypto_imports = []
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
for entry in pe.DIRECTORY_ENTRY_IMPORT:
dll = entry.dll.decode('utf-8', errors='replace')
for imp in entry.imports:
if imp.name:
name = imp.name.decode('utf-8', errors='replace')
if name in CRYPTO_APIS:
desc = CRYPTO_APIS[name]
crypto_imports.append((dll, name, desc))
print(f" [{dll}] {name}: {desc}")
if not crypto_imports:
print(" No known crypto APIs found in imports")
print(" Malware may use custom implementation or dynamic loading")
return crypto_imports
def find_crypto_constants(filepath):
"""Search for embedded cryptographic constants."""
with open(filepath, 'rb') as f:
data = f.read()
print("\n[+] Cryptographic Constants Search")
print("=" * 60)
offset = data.find(AES_SBOX)
if offset != -1:
print(f" AES S-Box found at offset 0x{offset:x}")
offset = data.find(CHACHA20_CONSTANT)
if offset != -1:
print(f" ChaCha20 constant at offset 0x{offset:x}")
rsa_markers = [
b'-----BEGIN PUBLIC KEY-----',
b'-----BEGIN RSA PUBLIC KEY-----',
b'\x30\x82',
]
for marker in rsa_markers:
offset = data.find(marker)
if offset != -1:
print(f" RSA key marker at offset 0x{offset:x}")
import re
ext_pattern = re.compile(rb'\.\w{3,10}(?=\x00)', re.IGNORECASE)
extensions = set()
for match in ext_pattern.finditer(data):
ext = match.group().decode('ascii', errors='replace').lower()
target_exts = [
'.doc', '.docx', '.xls', '.xlsx', '.pdf', '.ppt',
'.jpg', '.png', '.sql', '.mdb', '.bak', '.zip',
]
if ext in target_exts:
extensions.add(ext)
if extensions:
print(f"\n Target file extensions: {', '.join(sorted(extensions))}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: {sys.argv[0]} <ransomware_sample>")
sys.exit(1)
analyze_imports(sys.argv[1])
find_crypto_constants(sys.argv[1])
def analyze_encryption_pattern(filepath):
"""Analyze file encryption patterns from ransomware artifacts."""
import os
import struct
with open(filepath, 'rb') as f:
data = f.read()
file_size = len(data)
print(f"\n[+] Encrypted File Analysis: {filepath}")
print(f" Size: {file_size:,} bytes")
tail_sizes = [256, 512, 1024, 2048]
for size in tail_sizes:
if file_size > size + 16:
tail = data[-size:]
entropy = calculate_entropy(tail)
if entropy > 7.5:
print(f" Possible encrypted key ({size} bytes) "
f"at end of file (entropy: {entropy:.2f})")
header = data[:64]
print(f" First 16 bytes: {header[:16].hex()}")
known_headers = {
b'PK': 'ZIP/Office',
b'\x89PNG': 'PNG',
b'\xff\xd8\xff': 'JPEG',
b'%PDF': 'PDF',
b'\xd0\xcf\x11\xe0': 'OLE (DOC/XLS)',
}
for magic, ftype in known_headers.items():
if header.startswith(magic):
print(f" Original format preserved: {ftype}")
break
else:
print(" Original header destroyed/encrypted")
def calculate_entropy(data):
"""Calculate Shannon entropy of data."""
from collections import Counter
import math
if not data:
return 0
freq = Counter(data)
length = len(data)
entropy = -sum(
(count / length) * math.log2(count / length)
for count in freq.values()
)
return entropy
