Windows C++ / Checking Malware Name

Author Thomas Roccia (fr0gger)
Platform Windows
Language C++
Technique Checking Malware Name

Code

#include <iostream>
#include <cstring>
#include <windows.h>

using namespace std;

int main(int argc, char** argv)
{
    TCHAR szExeFileName[MAX_PATH];
    GetModuleFileName(NULL, szExeFileName, MAX_PATH);

    // full path
    cout << "[+] Full Path: " << szExeFileName << endl;

    //convert tchar to string
    std:string filename (szExeFileName);

    // Remove directory if present.
    const size_t last_slash_idx = filename.find_last_of("\\/");
    if (std::string::npos != last_slash_idx)
    {
        filename.erase(0, last_slash_idx + 1);
    }

    // Blacklist
    LPSTR fname[] = {"sample.exe",
                     "malware.exe",
                     // ADD YOUR PROCESS NAME HERE!
                    };
    for (int i = 0; i < (sizeof(fname) / sizeof(LPSTR)); i++)
    {
        if ((fname[i] == filename ))
        {
            cout << " [!] Filename is blacklisted: " << (fname[i]) << endl;
            exit(0);
        }
    }
    return 0;
}

Created

September 22, 2020

Last Revised

April 22, 2024