diff --git a/app/static/js/upload.js b/app/static/js/upload.js index 70f2e29..3231aec 100644 --- a/app/static/js/upload.js +++ b/app/static/js/upload.js @@ -53,7 +53,8 @@ document.addEventListener('DOMContentLoaded', function() { suspiciousImports: document.getElementById('suspiciousImports'), suspiciousImportsList: document.getElementById('suspiciousImportsList'), suspiciousImportsCount: document.getElementById('suspiciousImportsCount'), - suspiciousImportsSummary: document.getElementById('suspiciousImportsSummary') + suspiciousImportsSummary: document.getElementById('suspiciousImportsSummary'), + suspiciousImportsTitle: document.getElementById('suspiciousImportsTitle') }; @@ -258,31 +259,59 @@ document.addEventListener('DOMContentLoaded', function() { // Handle suspicious imports if (pe.suspicious_imports && pe.suspicious_imports.length > 0) { elements.suspiciousImports.classList.remove('hidden'); - elements.suspiciousImportsCount.textContent = `${pe.suspicious_imports.length} Found`; - elements.suspiciousImportsList.innerHTML = pe.suspicious_imports.map(imp => ` -
-
-
- ${imp.dll} - → - ${imp.function} - [${imp.category || 'Unknown'}] + // Check if it's a Go binary + const isGoBinary = pe.is_go_binary || false; + + // Update title and count with appropriate styling + if (isGoBinary) { + elements.suspiciousImportsTitle.textContent = 'API Imports Analysis (Go Runtime)'; + elements.suspiciousImportsCount.className = 'px-3 py-1 text-sm bg-blue-500/10 text-blue-400 rounded-full'; + elements.suspiciousImportsCount.textContent = `${pe.suspicious_imports.length} Found (Go Runtime)`; + } else { + elements.suspiciousImportsTitle.textContent = 'Suspicious Imports Analysis'; + elements.suspiciousImportsCount.className = 'px-3 py-1 text-sm bg-red-500/10 text-red-500 rounded-full'; + elements.suspiciousImportsCount.textContent = `${pe.suspicious_imports.length} Found`; + } + + elements.suspiciousImportsList.innerHTML = pe.suspicious_imports.map(imp => { + // Use different colors for Go runtime imports + const dllColor = isGoBinary ? 'text-blue-400' : 'text-red-500'; + const categoryBg = isGoBinary ? 'bg-blue-500/20' : 'bg-red-500/20'; + const categoryText = isGoBinary ? 'text-blue-400' : 'text-red-400'; + const borderColor = isGoBinary ? 'border-blue-900/20' : 'border-red-900/20'; + + return ` +
+
+
+ ${imp.dll} + → + ${imp.function} + [${imp.category || 'Unknown'}] + ${isGoBinary ? 'Go Runtime' : ''} +
+ ${imp.hint !== null && imp.hint !== undefined ? `Hint: ${imp.hint}` : ''} +
+
+ + + + ${imp.note}
- Hint: ${imp.hint}
-
- - - - ${imp.note} -
-
- `).join(''); + `; + }).join(''); - elements.suspiciousImportsSummary.textContent = - `Found ${pe.suspicious_imports.length} potentially suspicious imports that may indicate malicious capabilities.`; + // Update summary message based on Go binary detection + if (isGoBinary) { + elements.suspiciousImportsSummary.textContent = + `Go binary detected: ${pe.suspicious_imports.length} imports found are typically part of Go runtime and are not necessarily malicious.`; + } else { + elements.suspiciousImportsSummary.textContent = + `Found ${pe.suspicious_imports.length} potentially suspicious imports that may indicate malicious capabilities.`; + } } // Add checksum info display @@ -292,20 +321,35 @@ document.addEventListener('DOMContentLoaded', function() { elements.calculatedChecksum.textContent = pe.checksum_info.calculated_checksum; // Set checksum status - elements.checksumStatus.className = `px-3 py-1 text-sm rounded-full ${ - pe.checksum_info.is_valid ? 'bg-green-500/10 text-green-500' : 'bg-red-500/10 text-red-500' - }`; - elements.checksumStatus.textContent = pe.checksum_info.is_valid ? 'Valid' : 'Invalid'; + const isGoBinary = pe.checksum_info.is_go_binary || false; + const isValid = pe.checksum_info.is_valid; + + if (isValid) { + elements.checksumStatus.className = 'px-3 py-1 text-sm rounded-full bg-green-500/10 text-green-500'; + elements.checksumStatus.textContent = 'Valid'; + } else if (isGoBinary) { + elements.checksumStatus.className = 'px-3 py-1 text-sm rounded-full bg-blue-500/10 text-blue-400'; + elements.checksumStatus.textContent = 'Go Binary'; + } else { + elements.checksumStatus.className = 'px-3 py-1 text-sm rounded-full bg-red-500/10 text-red-500'; + elements.checksumStatus.textContent = 'Invalid'; + } // Add checksum notes if needed if (!pe.checksum_info.is_valid) { + const isGoBinary = pe.checksum_info.is_go_binary || false; + const noteText = isGoBinary + ? 'Go binaries typically have non-standard PE checksums - This is normal behavior' + : 'Invalid checksum - Common in packed/modified payloads'; + const iconColor = isGoBinary ? 'text-blue-500' : 'text-yellow-500'; + elements.checksumNotes.innerHTML = `
- + - Invalid checksum - Common in packed/modified payloads + ${noteText}
`; } diff --git a/app/templates/file_info.html b/app/templates/file_info.html index 3390282..e8410ca 100644 --- a/app/templates/file_info.html +++ b/app/templates/file_info.html @@ -193,6 +193,22 @@ {% if file_info.pe_info.checksum_info and not file_info.pe_info.checksum_info.is_valid %} + {% if file_info.pe_info.checksum_info.is_go_binary %} +
+

Go Binary Checksum

+

Go binaries typically have non-standard PE checksums - This is normal behavior

+
+
+

Stored Checksum

+

{{ file_info.pe_info.checksum_info.stored_checksum }}

+
+
+

Calculated Checksum

+

{{ file_info.pe_info.checksum_info.calculated_checksum }}

+
+
+
+ {% else %}

Checksum Mismatch

@@ -207,6 +223,7 @@
{% endif %} + {% endif %}
@@ -249,24 +266,55 @@
- {% if file_info.pe_info.suspicious_imports %}
-

Suspicious Imports

+ {% if file_info.pe_info.is_go_binary %} +

API Imports (Go Runtime)

+
+
+ + + + Go Binary Detected +
+

+ These imports are typically part of the Go runtime and are not necessarily malicious. + Go binaries automatically include these system calls for memory management, threading, and OS interaction. +

+
+ {% else %} +

Suspicious Imports

+ {% endif %} +
{% for dll, imports in file_info.pe_info.grouped_suspicious_imports.items() %} -
-

{{ dll }}

-
- {% for import in imports %} -
-

{{ import.function }} [{{ import.category }}]

-

{{ import.note }}

+ {% if file_info.pe_info.is_go_binary %} +
+

{{ dll }} Go Runtime

+
+ {% for import in imports %} +
+

{{ import.function }} [{{ import.category }}]

+

{{ import.note }}

+
+ {% endfor %}
- {% endfor %}
-
+ {% else %} +
+

{{ dll }}

+
+ {% for import in imports %} +
+

{{ import.function }} [{{ import.category }}]

+

{{ import.note }}

+
+ {% endfor %} +
+
+ {% endif %} {% endfor %}
diff --git a/app/templates/upload.html b/app/templates/upload.html index 4ccbb30..413b4c2 100644 --- a/app/templates/upload.html +++ b/app/templates/upload.html @@ -359,7 +359,7 @@