AV_Detection_Dump/AV_DUMP.ps1 at master · JerryLinLinLin/AV_Detection_Dump · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
<#
.Synopsis
	Antivirus Dump
.DESCRIPTION
	Dump an Antivirus software's detection name
.PARAMETER Name
    Choose an Antivirus: Huorong | Kaspersky | Malwarebytes
#>

#Requires -Version 4.0
#Requires -RunAsAdministrator

Param(
   [Parameter(Mandatory)]
   [validateset("Huorong","Kaspersky", "Malwarebytes")]
   [string]$Name
)

$TimeStamp = (Get-Date).ToString('MM-dd-yyyy-hh-mm-ss')
New-Item -ItemType Directory -Force $Name

$FileName = "$Name-$TimeStamp"
$DumpPath = "$FileName.dmp"
$StringPath = "$FileName.txt"


switch ($Name) {
    Huorong {
        $Regex = "^[A-Z][^/.=]{0,30}[/][A-Za-z]*[.][^/=]{0,20}$"

        procdump.exe -ma "HipsDaemon.exe" $DumpPath
        strings.exe -nobanner -n 7 "$FileName.dmp" > $StringPath

        $OutputPath = "$FileName-BASE.txt"
        select-string -Path $StringPath -Pattern $Regex -AllMatches | ForEach-Object { $_.Matches } | ForEach-Object { $_.Value } > $OutputPath

        $ResultPath = "$Name/$FileName-BASE.csv"
        Get-Content $OutputPath | Sort-Object | get-unique > $ResultPath

        Remove-Item $OutputPath
    }
    Kaspersky {
        $Regex_BASE = "^(?=[A-Z])(?!.*System.*|.*Windows.*|.*Microsoft.*|.*SCC.*|.*CLN.*|.*PDM.*|.*=.*|.*\\.*|.*//.*|.*\(.*)([^.]*)\.([^.]{1,10})\.([^.]*)\..*"
        $Regex_PDM = "^PDM:.*"

        procdump.exe -ma "avp.exe" $DumpPath
        strings.exe -nobanner -n 7 "$FileName.dmp" > $StringPath

        $OutputPath_BASE = "$FileName-BASE.txt"
        $OutputPath_PDM = "$FileName-PDM.txt"
        select-string -Path $StringPath -Pattern $Regex_BASE -AllMatches | ForEach-Object { $_.Matches } | ForEach-Object { $_.Value } > $OutputPath_BASE
        select-string -Path $StringPath -Pattern $Regex_PDM -AllMatches | ForEach-Object { $_.Matches } | ForEach-Object { $_.Value } > $OutputPath_PDM

        $ResultPath_BASE = "$Name/$FileName-BASE.csv"
        $ResultPath_PDM = "$Name/$FileName-PDM.csv"
        Get-Content $OutputPath_BASE | Sort-Object | get-unique > $ResultPath_BASE
        Get-Content $OutputPath_PDM | Sort-Object | get-unique > $ResultPath_PDM

        Remove-Item $OutputPath_BASE
        Remove-Item $OutputPath_PDM

    }
    Malwarebytes {
        $Regex_DDS = ".*.DDS$"

        procdump.exe -ma "MBAMService.exe" $DumpPath
        strings.exe -nobanner -u -n 7 "$FileName.dmp" > $StringPath

        $OutputPath_DDS = "$FileName-DDS.txt"
        $OutputPath_BASE = "$FileName-BASE.txt"
        select-string -Path $StringPath -Pattern $Regex_DDS -AllMatches | ForEach-Object { $_.Matches } | ForEach-Object { $_.Value } > $OutputPath_DDS

        $Range = $false
        Get-Content -Path $StringPath | Foreach-Object {
            if($_ -match "PUP.Optional.Bandoo.AppFlsh"){
                $Range = $true
            }
            if($_ -match "Toshiba.MBR"){
                $Range = $false
            }
            if ($Range) {
                Add-Content $OutputPath_BASE $_
            }
        }

        $ResultPath_DDS = "$Name/$FileName-DDS.csv"
        $ResultPath_BASE = "$Name/$FileName-BASE.csv"
        Get-Content $OutputPath_DDS | Sort-Object | get-unique > $ResultPath_DDS
        Get-Content $OutputPath_BASE | Sort-Object | get-unique > $ResultPath_BASE

        Remove-Item $OutputPath_BASE
        Remove-Item $OutputPath_DDS
    }
    Default {
        return
    }
}

Remove-Item $DumpPath
Remove-Item $StringPath