scanner.py

import hashlib
import os

# ================= SUSPICIOUS DATA ================= #

suspicious_keywords = [
    "keylogger",
    "powershell",
    "token",
    "webhook",
    "stealer",
    "grabber",
    "cookie",
    "discord",
    "logger",
    "crypto",
    "miner"
]

# ================= DANGEROUS EXTENSIONS ================= #

dangerous_extensions = [
    ".exe",
    ".bat",
    ".vbs",
    ".cmd",
    ".scr",
    ".ps1"
]

# ================= HASH FUNCTION ================= #

def generate_hash(file_path):

    sha256 = hashlib.sha256()

    with open(file_path, "rb") as file:

        while chunk := file.read(4096):
            sha256.update(chunk)

    return sha256.hexdigest()


# ================= MAIN SCANNER ================= #

def scan_file(file_path):

    result = ""
    threat_score = 0

    # ================= FILE INFO ================= #

    file_name = os.path.basename(file_path)
    file_size = os.path.getsize(file_path)
    extension = os.path.splitext(file_path)[1]

    result += "========== FILE ANALYSIS =========="
    result += f"\n\nFile Name: {file_name}"
    result += f"\nFile Size: {file_size} bytes"
    result += f"\nExtension: {extension}\n\n"

    # ================= EXTENSION CHECK ================= #

    if extension.lower() in dangerous_extensions:

        result += "[!] Dangerous Extension Detected\n"
        threat_score += 40

    else:

        result += "[+] Extension appears safe\n"

    # ================= HASH ================= #

    file_hash = generate_hash(file_path)

    result += f"\nSHA256 HASH:\n{file_hash}\n\n"

    # ================= CONTENT ANALYSIS ================= #

    found_keywords = []

    try:

        with open(file_path, "r", errors="ignore") as file:

            content = file.read().lower()

            for keyword in suspicious_keywords:

                if keyword in content:

                    found_keywords.append(keyword)
                    threat_score += 10

    except:

        result += "[!] Could not fully inspect file content\n\n"

    # ================= RESULTS ================= #

    if found_keywords:

        result += "========== SUSPICIOUS KEYWORDS =========="
        result += "\n\n"

        for keyword in found_keywords:
            result += f"- {keyword}\n"

        result += "\n"

    else:

        result += "[+] No suspicious keywords detected\n\n"

    # ================= THREAT LEVEL ================= #

    result += "========== THREAT ANALYSIS ==========\n\n"
    result += f"Threat Score: {threat_score}/100\n\n"

    if threat_score >= 70:

        result += "Threat Level: HIGH"

    elif threat_score >= 40:

        result += "Threat Level: MEDIUM"

    else:

        result += "Threat Level: LOW"

    return result