#!/bin/bash

#Version 2 2015/03/23
#updated to work with VT and the new build.

#This little script is designed to work on a debian based distro
#it will output file info including hashes and strings
#to a specific directory.

#Change this variable to change the output directory
PARENTDIR="$HOME/work/file_analysis"
#add your prefered browser here...
BROWSER="/usr/bin/firefox"

SHASUM="/usr/bin/shasum"
SHA256SUM="/usr/bin/sha256sum"
STRINGS="/usr/bin/strings"
MD5SUM="/usr/bin/md5sum"
#HEAD="/usr/bin/head"
WGET="/usr/bin/wget"
CURL="/usr/bin/curl"
CUT="/usr/bin/cut"
DATE=$(/bin/date +%y_%m_%d)
FILE="/usr/bin/file"
HEXDUMP="/usr/bin/hexdump"

TARGETFILE=$($SHA256SUM $1 | cut -d " " -f 1)
MD5SUMHASH=$($MD5SUM $1 | cut -d " " -f 1)

OUTPUTDIR="$PARENTDIR/$DATE""_""$TARGETFILE"
OUTPUTFILEPREFIX="$OUTPUTDIR""/"

HASHFILE="$TARGETFILE""_""hashes""_"

STRINGSDEFAULTOUT="$TARGETFILE""_""strings_default.txt"
STRINGSDEFAULTOUT_PREFIXED="$OUTPUTFILEPREFIX""$STRINGSDEFAULTOUT"

STRINGS6OUT="$TARGETFILE""_""strings_6_chars.txt"
STRINGS6OUT_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS6OUT"

STRINGS_s="$TARGETFILE""_""strings_7bit.txt"
STRINGS_s_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_s"

STRINGS_S="$TARGETFILE""_""strings_8bit.txt"
STRINGS_S_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_S"

STRINGS_b="$TARGETFILE""_""strings_16bit_big_endian.txt"
STRINGS_b_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_b"

STRINGS_l="$TARGETFILE""_""strings_16bit_little_endian.txt"
STRINGS_l_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_l"

STRINGS_B="$TARGETFILE""_""strings_32bit_big_endian.txt"
STRINGS_B_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_B"

STRINGS_L="$TARGETFILE""_""strings_32bit_little_endian.txt"
STRINGS_L_PREFIXED="$OUTPUTFILEPREFIX""$STRINGS_L"

FILEOUT="$TARGETFILE""_""file_info.txt"
FILEOUT_PREFIXED="$OUTPUTFILEPREFIX""$FILEOUT"

SHASUMOUT="$HASHFILE""sha.txt"
SHASUMOUT_PREFIXED="$OUTPUTFILEPREFIX""$SHASUMOUT"

VIRUSTOTALOUT_SHA256="$TARGETFILE""_""virus_total_sha256.html"
VIRUSTOTALOUT_PREFIXED_SHA256="$OUTPUTFILEPREFIX""$VIRUSTOTALOUT_SHA256"

HEXDUMPOUT="$$TARGETFILE""_""hex_dump_head.txt"
HEXDUMPOUT_PREFIXED="$OUTPUTFILEPREFIX""$HEXDUMPOUT"

OUTPUTINDEX="$TARGETFILE""_""index.html"
OUTPUTINDEX_PREFIXED="$OUTPUTFILEPREFIX""$OUTPUTINDEX"

if [ ! -z "$1" ] && [ -e "$1" ] && [ ! -d "$1" ]; then
	if [ ! -e "$OUTPUTDIR" ]; then mkdir -p "$OUTPUTDIR"; fi
	
	echo "<html>" > $OUTPUTINDEX_PREFIXED
	echo -e "\t<head>" >> $OUTPUTINDEX_PREFIXED
	echo -e "\t\t<title>$TARGETFILE Analysis $DATE </title>" >> $OUTPUTINDEX_PREFIXED
	echo -e "\t</head>" >> $OUTPUTINDEX_PREFIXED
	echo -e "\t<body>" >> $OUTPUTINDEX_PREFIXED
	
	$STRINGS "$1" > "$STRINGSDEFAULTOUT_PREFIXED"
	$STRINGS -n 6 "$1" > "$STRINGS6OUT_PREFIXED"
	$STRINGS -e s "$1" > $STRINGS_s_PREFIXED
	$STRINGS -e S "$1" > $STRINGS_S_PREFIXED
	$STRINGS -e b "$1" > $STRINGS_b_PREFIXED
	$STRINGS -e l "$1" > $STRINGS_l_PREFIXED
	$STRINGS -e B "$1" > $STRINGS_B_PREFIXED
	$STRINGS -e L "$1" > $STRINGS_L_PREFIXED

	$FILE "$1" > "$FILEOUT_PREFIXED"

	$HEXDUMP -n 1000 -C "$1" > "$HEXDUMPOUT_PREFIXED"
	
	rm $SHASUMOUT_PREFIXED
	echo -e "Hash analysis of "$1"\n\n" >> "$SHASUMOUT_PREFIXED"
	echo -e "MD5:""$MD5SUMHASH""\n" >> "$SHASUMOUT_PREFIXED"

	for i in `echo "1 224 256 384 512"`; do 
		X=$($SHASUM -a "$i" "$1" | cut -d " " -f 1)
		echo -e "Sha""$i"":""$X""\n" >> "$SHASUMOUT_PREFIXED"
	done                       

	$CURL --data "query=$TARGETFILE" -L "https://www.virustotal.com/en/search/" -o "$VIRUSTOTALOUT_PREFIXED_SHA256" -H "Accept-Language: en-GB,en"

	echo "<p><b>Analysis of $1</b></p></ br>" >> $OUTPUTINDEX_PREFIXED
	#echo "<p>$TARGETFILE</p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGSDEFAULTOUT\">Default Strings File</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS6OUT\">Minimum of 6 Characters Strings File</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_s\">7 bit character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_S\">8 bit character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_b\">16 bit big endian character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_l\">16 bit little endian character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_B\">32 bit big endian character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$STRINGS_L\">32 bit little endian character strings</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$FILEOUT\">File Command Output</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$SHASUMOUT\">Hash Output</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$VIRUSTOTALOUT_SHA256\">VirusTotal sha256 Output</a></p></ br>" >> $OUTPUTINDEX_PREFIXED
	echo "<p><a href=\"$HEXDUMPOUT\">Hexdump (1000bytes)</a></p></ br>" >> $OUTPUTINDEX_PREFIXED

	echo -e "\t</body>" >> $OUTPUTINDEX_PREFIXED
	echo -e "</html>" >> $OUTPUTINDEX_PREFIXED
	
	$BROWSER $OUTPUTINDEX_PREFIXED

	#echo $VIRUSTOTALOUT_SHA256
	#echo $VIRUSTOTALOUT_PREFIXED_SHA256
	#echo $MD5
	echo "$STRINGS -e b $1 > $STRINGS_b_PREFIXED"
	
else
	echo "Usage: cirt_file_analysis [FILE]"; 
fi
