-4

want to create a program that can check a file and give output about file is in infected or not,also need to know what kind of infection that file have (ex : Trojan, worms, etc )
Is there a way to create such analyzer using java or python without using an API ?

4
  • This question is off-topic and too broad. You're asking how to create a piece of software, it's a lot better suited to SO rather than here. And what you're asking is too broad regardless. You need to provide evidence of your research, how you think you will start, how it will work and various other things. You cannot just simply ask how to create a program.
    – user173641
    May 28 '18 at 3:37
  • I totally agree with @JoshJones and the answers by CaffeineAddiction and Abdullah but for starters if you are looking at an easy way of doing it without going through the hassle of identifying malicious files you can maybe go through the Virus Total APIs or similar sites that offer this feature. I did see that you do not want an API based solution but this is the easiest way I can think of doing it without getting into the complexities of malware analysis and reverse engineering. May 28 '18 at 5:00
  • 1
    Antivirus companies have spent thousands of man-years on this or more. You won't be able to compete with them, but if you narrow down your scope a lot you might be able to write a toy one.
    – user253751
    May 28 '18 at 6:25
  • You should first look for a book to study how manual malware analysis looks like.
    – mootmoot
    May 28 '18 at 7:30
1

I want to clarify one thing before answering you question, malware is short term for (malicious software) which includes Trojans, Viruses, Worms, etc...

In response to your question, malware analysis is large subject. It is very hard to do such a program, you need to be a malware analyst to understand how different malware work, how to analyze them and understand their malicious behavior.

Your program should be able to identify if the file is packed, if so, it should unpack it with the right tools, recognize any malicious behavior and many other things to consider.

If you are determined to do the program, I advise you to read Practical Malware Analysis book, understand how malware analysis works, then you can start building your program with a solid understanding of how your program is supposed to work and what it should do.

Hope this helps :)

0

This question might be better suited for Stack Overflow, however, if I wanted to go about this:

  • I would start with a fresh install of an OS and get a md5 & sha256 hash of every file on the hard drive so as to compare known good files against potentially harmful files. A scan would also need to be triggered when new Media is connected (eg CD or Thumbdrive).
  • I would look up the OS's API for events in which files are accessed and attempt to scan each of these files as they are loaded into memory and/or created/modified.
  • I would look up the OS's API for events in which network addresses are accessed.

After having written a service to preform all 3 of the above steps, I would use results to create a white list of known good files, known bad files, and user modified files which could go either way. This information from a single computer would not be all that useful however ... it would be much better to get these same statistics from a larger user-base to get a more accurate view of good vs bad.

Now, given all that I have listed above ... I would not infact write my own anti-virus ... for the same reason I would not write my own crypto. These things are better left to professionals who get paid to reverse engineer viruses and malware on a daily basis.

If you really want to learn more however, it might be easier done by looking through the code of an OpenSource project like ClamAV

Not the answer you're looking for? Browse other questions tagged or ask your own question.