MalwareHunter.cpp

// MalwareHunter - A malware detection tool for Windows operating systems.
//
// Author: Jacob Gajek <jgajek@gmail.com>
//
// This code is in the public domain.

#include "stdafx.h"

#include <mscat.h>
#include <SoftPub.h>
#include <strsafe.h>
#include <wincrypt.h>
#include <Shlwapi.h>

#include <string>

#pragma comment(lib, "wintrust")
#pragma comment(lib, "crypt32")
#pragma comment(lib, "shlwapi")

#define LOG(msg)	LogMessage(msg)

using namespace std;

/*-----------------------------*
 * Executable image entry      *
 *-----------------------------*/

typedef struct _EXECUTABLE {
	LPTSTR	exeName;
	LPTSTR	exePath;
	TCHAR	exeHash[128];
	TCHAR	signer[512];
	TCHAR	issuer[512];
	BOOL	isTrusted;
} EXECUTABLE, *PEXECUTABLE;


VOID LogMessage(LPCTSTR msg);
VOID PrintExecutable(PEXECUTABLE pexe);
VOID PrintAutorun(LPCTSTR regKey, PEXECUTABLE pexe);
BOOL CalculateMD5Hash(HANDLE hFile, PBYTE pbHash, PDWORD pcbHash);
VOID ConvertHash(TCHAR szBuffer[], DWORD ccBuffer, PBYTE pbHash, DWORD cbHash);
BOOL VerifySignature(PEXECUTABLE pexe);
BOOL GetSignatureInfo(LPCWSTR path, PEXECUTABLE pexe);
LPWSTR ExtractExePath(LPWSTR path);
BOOL EnumProcesses(BOOL showAll);
BOOL EnumAutoruns(BOOL showAll);

// Log message to console
VOID LogMessage(LPCTSTR msg)
{
	TCHAR sysmsg[512];

	FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_MAX_WIDTH_MASK,
		NULL,
		GetLastError(),
		MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
		sysmsg,
		ARRAYSIZE(sysmsg),
		NULL);

	_tprintf(TEXT("%s: %s\n"), msg, sysmsg);
}

// Print out pipe-delimited output fields for a running process
VOID PrintExecutable(PEXECUTABLE pexe)
{
	_tprintf(TEXT("%s|%s|%s|%s|%s|%s\n"),
		pexe->exeName,
		pexe->exePath,
		pexe->exeHash,
		pexe->signer,
		pexe->issuer,
		pexe->isTrusted ? TEXT("Trusted") : TEXT("Untrusted"));
}

// Print out pipe-delimited output fields for an autorun entry
VOID PrintAutorun(LPCTSTR regKey, PEXECUTABLE pexe)
{
	_tprintf(TEXT("%s|%s|%s|%s|%s|%s|%s\n"),
		regKey,
		pexe->exeName,
		pexe->exePath,
		pexe->exeHash,
		pexe->signer,
		pexe->issuer,
		pexe->isTrusted ? TEXT("Trusted") : TEXT("Untrusted"));
}

// Calculate MD5 hash of file
BOOL CalculateMD5Hash(HANDLE hFile, PBYTE pbHash, PDWORD pcbHash)
{
	HCRYPTPROV hProv;
	HCRYPTHASH hHash;
	BYTE buffer[64*1024];
	DWORD cbRead;
	BOOL result;

	if (!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
	{
		LOG(TEXT("CryptAcquireContext error"));
		return FALSE;
	}

	if (!CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
	{
		LOG(TEXT("CryptCreateHash error"));
		CryptReleaseContext(hProv, 0);
		return FALSE;
	}

	while (result = ReadFile(hFile, buffer, sizeof(buffer), &cbRead, NULL))
	{
		if (cbRead == 0)
		{
			break;
		}

		if (!CryptHashData(hHash, buffer, cbRead, 0))
		{
			LOG(TEXT("CryptHashData error"));
			CryptDestroyHash(hHash);
			CryptReleaseContext(hProv, 0);
			return FALSE;
		}
	}

	if (!result)
	{
		LOG(TEXT("ReadFile error"));
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return FALSE;
	}

	if (!CryptGetHashParam(hHash, HP_HASHVAL, pbHash, pcbHash, 0))
	{
		LOG(TEXT("CryptGetHashParam error"));
		CryptDestroyHash(hHash);
		CryptReleaseContext(hProv, 0);
		return FALSE;
	}

	CryptDestroyHash(hHash);
	CryptReleaseContext(hProv, 0);
	return TRUE;
}

// Convert hash bytes to readable hex string
VOID ConvertHash(TCHAR szBuffer[], DWORD ccBuffer, PBYTE pbHash, DWORD cbHash)
{
	static const TCHAR hex_char[] = {
		TEXT('0'), TEXT('1'), TEXT('2'), TEXT('3'), TEXT('4'), TEXT('5'), TEXT('6'), TEXT('7'),
		TEXT('8'), TEXT('9'), TEXT('a'), TEXT('b'), TEXT('c'), TEXT('d'), TEXT('e'), TEXT('f')
	};

	UINT i, j;

	for (i = 0, j = 0; i < cbHash && j < ccBuffer - 1; i++, j += 2)
	{
		szBuffer[j] = hex_char[(pbHash[i] & 0xF0) >> 4];
		szBuffer[j + 1] = hex_char[pbHash[i] & 0x0F];
	}

	szBuffer[j] = TEXT('\0');
}

// Get subject name of signer certificate
BOOL GetSignatureInfo(LPCWSTR filePath, PEXECUTABLE pexe)
{
	HCERTSTORE hStore;
	HCRYPTMSG hMsg;
	PCMSG_SIGNER_INFO pSigner;
	PCCERT_CONTEXT pCert;
	CERT_INFO certInfo;
	DWORD dwEncoding;
	DWORD dwContent;
	DWORD dwFormat;
	DWORD cbData;

	// Extract digital signature info from file
	if (!CryptQueryObject(CERT_QUERY_OBJECT_FILE, filePath, CERT_QUERY_CONTENT_FLAG_PKCS7_SIGNED_EMBED, CERT_QUERY_FORMAT_FLAG_BINARY,
		0, &dwEncoding, &dwContent, &dwFormat, &hStore, &hMsg, NULL))
	{
		StringCchPrintf(pexe->signer, ARRAYSIZE(pexe->signer), TEXT("(signature not found)"));
		StringCchPrintf(pexe->issuer, ARRAYSIZE(pexe->issuer), TEXT("(signature not found)"));
		return FALSE;
	}

	StringCchPrintf(pexe->signer, ARRAYSIZE(pexe->signer), TEXT("(error processing signature)"));
	StringCchPrintf(pexe->issuer, ARRAYSIZE(pexe->issuer), TEXT("(error processing signature)"));

	// Get size of signer info
	if (!CryptMsgGetParam(hMsg, CMSG_SIGNER_INFO_PARAM, 0, NULL, &cbData))
	{
		LOG(TEXT("CryptMsgGetParam error"));
		CertCloseStore(hStore, 0);
		CryptMsgClose(hMsg);
		return FALSE;
	}

	// Allocate memory for signer info
	pSigner = (PCMSG_SIGNER_INFO)malloc(cbData);
	if (pSigner == NULL)
	{
		LOG(TEXT("Memory allocation error"));
		CertCloseStore(hStore, 0);
		CryptMsgClose(hMsg);
		return FALSE;
	}

	// Extract signer info
	if (!CryptMsgGetParam(hMsg, CMSG_SIGNER_INFO_PARAM, 0, pSigner, &cbData))
	{
		LOG(TEXT("CryptMsgGetParam error"));
		CertCloseStore(hStore, 0);
		CryptMsgClose(hMsg);
		free(pSigner);
		return FALSE;
	}

	certInfo.Issuer = pSigner->Issuer;
	certInfo.SerialNumber = pSigner->SerialNumber;

	// Get signer certificate context
	pCert = CertFindCertificateInStore(hStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_CERT, &certInfo, NULL);
	if (pCert == NULL)
	{
		LOG(TEXT("CertFindCertificateInStore error"));
		CertCloseStore(hStore, 0);
		CryptMsgClose(hMsg);
		free(pSigner);
		return FALSE;
	}

	// Extract signer and issuer names
	CertGetNameString(pCert, CERT_NAME_FRIENDLY_DISPLAY_TYPE, 0, NULL, pexe->signer, ARRAYSIZE(pexe->signer));
	CertGetNameString(pCert, CERT_NAME_FRIENDLY_DISPLAY_TYPE, CERT_NAME_ISSUER_FLAG, NULL, pexe->issuer, ARRAYSIZE(pexe->issuer));

	// Clean up
	CertFreeCertificateContext(pCert);
	CertCloseStore(hStore, 0);
	CryptMsgClose(hMsg);
	free(pSigner);
	return TRUE;
}

// Verify digital signature of process entry
BOOL VerifySignature(PEXECUTABLE pexe)
{
	HCATADMIN hCatAdmin;
	HCATINFO hCatInfo;
	CATALOG_INFO CatInfo = {};
	HANDLE hFile;
	DWORD cbHash;
	PBYTE pbHash;
	GUID gAction;
	WINTRUST_DATA WinTrustData = {};
	WINTRUST_CATALOG_INFO WinTrustCatalog = {};
	WINTRUST_FILE_INFO WinTrustFile = {};

	StringCchPrintf(pexe->signer, ARRAYSIZE(pexe->signer), TEXT("(error processing signature)"));
	StringCchPrintf(pexe->issuer, ARRAYSIZE(pexe->issuer), TEXT("(error processing signature)"));
	pexe->isTrusted = FALSE;

	// Acquire administrator context for signature validation using catalog database.
	if (!CryptCATAdminAcquireContext(&hCatAdmin, NULL, 0))
	{
		LOG(TEXT("CryptCATAdminAcquireContext error"));
		return FALSE;
	}

	// Open executable file for reading.
	hFile = CreateFile(pexe->exePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, 0, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
	{
		LOG(TEXT("CreateFile error"));
		CryptCATAdminReleaseContext(hCatAdmin, NULL);
		return FALSE;
	}

	// Calculate size of buffer needed to store the catalog hash value.
	if (!CryptCATAdminCalcHashFromFileHandle(hFile, &cbHash, NULL, 0))
	{
		LOG(TEXT("CryptCATAdminCalcHashFromFileHandle error"));
		CloseHandle(hFile);
		CryptCATAdminReleaseContext(hCatAdmin, NULL);
		return FALSE;
	}

	// Allocate memory for hash.
	pbHash = (PBYTE)malloc(max(16, cbHash));
	if (pbHash == NULL)
	{
		LOG(TEXT("Memory allocation error"));
		CloseHandle(hFile);
		CryptCATAdminReleaseContext(hCatAdmin, NULL);
		return FALSE;
	}

	// Calculate catalog hash of file.
	if (!CryptCATAdminCalcHashFromFileHandle(hFile, &cbHash, pbHash, 0))
	{
		LOG(TEXT("CryptCATAdminCalcHashFromFileHandle error"));
		CloseHandle(hFile);
		free(pbHash);
		CryptCATAdminReleaseContext(hCatAdmin, NULL);
		return FALSE;
	}

	/*----------------------------------------------------*/
	/* Try to locate the file hash in a catalog database. */
	/*----------------------------------------------------*/
	
	gAction = WINTRUST_ACTION_GENERIC_VERIFY_V2;

	WinTrustData.cbStruct = sizeof(WINTRUST_DATA);
	WinTrustData.pPolicyCallbackData = NULL;
	WinTrustData.pSIPClientData = NULL;
	WinTrustData.dwUIChoice = WTD_UI_NONE;
	WinTrustData.fdwRevocationChecks = WTD_REVOKE_WHOLECHAIN;
	WinTrustData.dwUnionChoice = WTD_CHOICE_CATALOG;
	WinTrustData.hWVTStateData = NULL;
	WinTrustData.pwszURLReference = NULL;
	WinTrustData.dwProvFlags = WTD_REVOCATION_CHECK_CHAIN;
	WinTrustData.pCatalog = &WinTrustCatalog;
	WinTrustData.dwUIContext = WTD_UICONTEXT_EXECUTE;

	WinTrustCatalog.cbStruct = sizeof(WINTRUST_CATALOG_INFO);
	WinTrustCatalog.dwCatalogVersion = 0;
	WinTrustCatalog.pcwszCatalogFilePath = CatInfo.wszCatalogFile;
	WinTrustCatalog.pcwszMemberTag = NULL;
	WinTrustCatalog.pcwszMemberFilePath = pexe->exePath;
	WinTrustCatalog.hMemberFile = hFile;
	WinTrustCatalog.pbCalculatedFileHash = pbHash;
	WinTrustCatalog.cbCalculatedFileHash = cbHash;
	WinTrustCatalog.pcCatalogContext = NULL;
#ifdef _WIN64
	WinTrustCatalog.hCatAdmin = hCatAdmin;
#endif

	CatInfo.cbStruct = sizeof(CATALOG_INFO);

	// Traverse list of catalogs that contain the calculated hash, and try to verify the digital signature against each one.
	hCatInfo = CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, 0, NULL);
	while (hCatInfo != NULL)
	{
		if (CryptCATCatalogInfoFromContext(hCatInfo, &CatInfo, 0))
		{
			WinTrustData.dwStateAction = WTD_STATEACTION_VERIFY;

			if (WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &gAction, &WinTrustData) == 0)
			{
				GetSignatureInfo(CatInfo.wszCatalogFile, pexe);
				pexe->isTrusted = TRUE;
			}
			else
			{
				GetSignatureInfo(CatInfo.wszCatalogFile, pexe);
				pexe->isTrusted = FALSE;
			}

			WinTrustData.dwStateAction = WTD_STATEACTION_CLOSE;
			WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &gAction, &WinTrustData);

			if (pexe->isTrusted)
			{
				break;
			}
		}
		hCatInfo = CryptCATAdminEnumCatalogFromHash(hCatAdmin, pbHash, cbHash, 0, &hCatInfo);
	}

	CryptCATAdminReleaseCatalogContext(hCatAdmin, hCatInfo, 0);
	CryptCATAdminReleaseContext(hCatAdmin, 0);

	// Calculate MD5 hash of file and convert to hex string.
	if (CalculateMD5Hash(hFile, pbHash, &cbHash))
	{
		ConvertHash(pexe->exeHash, ARRAYSIZE(pexe->exeHash), pbHash, cbHash);
	}

	free(pbHash);

	if (pexe->isTrusted)
	{
		CloseHandle(hFile);
		return TRUE;
	}

	/*-----------------------------------------------*/
	/* Try to verify the embedded signature in file. */
	/*-----------------------------------------------*/

	WinTrustData.dwUnionChoice = WTD_CHOICE_FILE;
	WinTrustData.pFile = &WinTrustFile;

	WinTrustFile.cbStruct = sizeof(WINTRUST_FILE_INFO);
	WinTrustFile.pcwszFilePath = pexe->exePath;
	WinTrustFile.hFile = hFile;

	WinTrustData.dwStateAction = WTD_STATEACTION_VERIFY;
	if (WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &gAction, &WinTrustData) == 0)
	{
		GetSignatureInfo(pexe->exePath, pexe);
		pexe->isTrusted = TRUE;
	}
	else
	{
		GetSignatureInfo(pexe->exePath, pexe);
		pexe->isTrusted = FALSE;
	}

	WinTrustData.dwStateAction = WTD_STATEACTION_CLOSE;
	WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &gAction, &WinTrustData);

	CloseHandle(hFile);
	return TRUE;
}

// Extract executable image path from registry value
LPWSTR ExtractExePath(LPWSTR path)
{
	_wcslwr_s(path, lstrlen(path) + 1);

	LPWSTR newpath = path;
	wstring tmppath(path);
	wstring::size_type m;
	wstring::size_type n;

	m = tmppath.find(TEXT("rundll32.exe "));
	if (m != wstring::npos)
	{
		// Extract path argument passed to rundll32.exe
		newpath = &path[m + 13];

		n = tmppath.rfind(TEXT(","));
		if (n != wstring::npos && n > m)
		{
			path[n] = (TCHAR)0;
		}
	}
	else
	{
		// Discard command-line arguments
		n = tmppath.rfind(TEXT(".exe "));
		if (n != wstring::npos)
		{
			path[n + 4] = (TCHAR)0;
		}
	}

	PathUnquoteSpaces(newpath);
	return newpath;
}

// List executables loaded by registry autorun entries. If showAll is true, then list all executables, otherwise list only untrusted ones.
BOOL EnumAutoruns(BOOL showAll)
{
	HKEY hKey;
	DWORD cValues;
	DWORD cchMaxValueNameLen;
	DWORD cbMaxValueLen;
	LPTSTR szValueName;
	LPTSTR szValue;
	EXECUTABLE exe;

	static LPCTSTR autoruns[] = {
		TEXT("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"),
		TEXT("SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run")
	};

	for (WORD i = 0; i < ARRAYSIZE(autoruns); i++)
	{
		if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, autoruns[i], 0, KEY_READ, &hKey) != ERROR_SUCCESS)
		{
			continue;
		}

		if (RegQueryInfoKey(hKey, NULL, NULL, NULL, NULL, NULL, NULL, &cValues, &cchMaxValueNameLen, &cbMaxValueLen, NULL, NULL) != ERROR_SUCCESS)
		{
			RegCloseKey(hKey);
			continue;
		}

		szValueName = (LPTSTR)malloc((cchMaxValueNameLen + 1) * sizeof(TCHAR));
		szValue = (LPTSTR)malloc(cbMaxValueLen + sizeof(TCHAR));

		if (szValueName == NULL || szValue == NULL)
		{
			LOG(TEXT("Memory allocation error"));
			RegCloseKey(hKey);
			continue;
		}

		for (DWORD j = 0; j < cValues; j++)
		{
			DWORD cchValueNameLen = cchMaxValueNameLen + 1;
			DWORD cbValueLen = cbMaxValueLen + 1;

			if (RegEnumValue(hKey, j, szValueName, &cchValueNameLen, NULL, NULL, (LPBYTE)szValue, &cbValueLen) != ERROR_SUCCESS)
			{
				LOG(TEXT("RegEnumValue error"));
			}
			else
			{
				exe.exeName = szValueName;
				exe.exePath = ExtractExePath(szValue);
				exe.exeHash[0] = TEXT('\0');
				exe.signer[0] = TEXT('\0');
				exe.issuer[0] = TEXT('\0');
				exe.isTrusted = FALSE;

				if (PathFileExists(exe.exePath))
				{
					VerifySignature(&exe);
				}

				if (showAll || !exe.isTrusted)
				{
					PrintAutorun(autoruns[i], &exe);
				}
			}
		}

		free(szValueName);
		free(szValue);

		RegCloseKey(hKey);
	}

	return TRUE;
}

// List running processes. If showAll is true, then list all processes, otherwise list only untrusted ones.
BOOL EnumProcesses(BOOL showAll)
{
	HANDLE hProcessSnapshot;
	HANDLE hModuleSnapshot;
	PROCESSENTRY32 pe32;
	MODULEENTRY32 me32;
	EXECUTABLE exe;

	// Take a snapshot of all processes in the system
	hProcessSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hProcessSnapshot == INVALID_HANDLE_VALUE)
	{
		LOG(TEXT("CreateToolhelp32Snapshot (PROCESS) error"));
		return FALSE;
	}

	pe32.dwSize = sizeof(PROCESSENTRY32);

	// Get info for first process in snapshot
	if (!Process32First(hProcessSnapshot, &pe32))
	{
		LOG(TEXT("Process32First error"));
		CloseHandle(hProcessSnapshot);
		return FALSE;
	}

	hModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pe32.th32ProcessID);
	while (hModuleSnapshot == INVALID_HANDLE_VALUE)
	{
		if (GetLastError() == ERROR_BAD_LENGTH)
		{
			hModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pe32.th32ProcessID);
			continue;
		}
		else
		{
			break;
		}
	}

	if (hModuleSnapshot != INVALID_HANDLE_VALUE)
	{
		me32.dwSize = sizeof(MODULEENTRY32);

		if (Module32First(hModuleSnapshot, &me32))
		{
			exe.exeName = pe32.szExeFile;
			exe.exePath = me32.szExePath;
			exe.exeHash[0] = TEXT('\0');
			exe.signer[0] = TEXT('\0');
			exe.issuer[0] = TEXT('\0');
			exe.isTrusted = FALSE;

			if (PathFileExists(exe.exePath))
			{
				VerifySignature(&exe);
			}

			if (showAll || !exe.isTrusted)
			{
				PrintExecutable(&exe);
			}
		}

		CloseHandle(hModuleSnapshot);
	}

	// Traverse list of running processes
	while (Process32Next(hProcessSnapshot, &pe32))
	{
		hModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pe32.th32ProcessID);
		while (hModuleSnapshot == INVALID_HANDLE_VALUE)
		{
			if (GetLastError() == ERROR_BAD_LENGTH)
			{
				hModuleSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, pe32.th32ProcessID);
				continue;
			}
			else
			{
				break;
			}
		}

		if (hModuleSnapshot != INVALID_HANDLE_VALUE)
		{
			me32.dwSize = sizeof(MODULEENTRY32);

			if (Module32First(hModuleSnapshot, &me32))
			{
				exe.exeName = pe32.szExeFile;
				exe.exePath = me32.szExePath;
				exe.exeHash[0] = TEXT('\0');
				exe.signer[0] = TEXT('\0');
				exe.issuer[0] = TEXT('\0');
				exe.isTrusted = FALSE;

				if (PathFileExists(exe.exePath))
				{
					VerifySignature(&exe);
				}

				if (showAll || !exe.isTrusted)
				{
					PrintExecutable(&exe);
				}
			}

			CloseHandle(hModuleSnapshot);
		}
	}

	// Clean up
	CloseHandle(hProcessSnapshot);
	return TRUE;
}


int _tmain(int argc, _TCHAR* argv[])
{
	BOOL showAll = FALSE;
	BOOL showReg = FALSE;
	BOOL showMem = FALSE;

	for (WORD i = 1; i < argc; i++)
	{
		if (!lstrcmp(argv[i], TEXT("all")))
		{
			showAll = TRUE;
			continue;
		}

		if (!lstrcmp(argv[i], TEXT("reg")))
		{
			showReg = TRUE;
			continue;
		}

		if (!lstrcmp(argv[i], TEXT("mem")))
		{
			showMem = TRUE;
			continue;
		}
	}

	if (showMem)
	{
		EnumProcesses(showAll);
	}

	if (showReg)
	{
		EnumAutoruns(showAll);
	}

	return 0;
}