Merge pull request #45 from Bor-Code/feat/add-suspicious-dll-summary

feat: add suspicious DLL summary

Author: Bor-Code

include/analyzer/pe_parser.hpp

@@ -76,6 +76,7 @@ struct SuspiciousApiReport {
     std::string apiName;
     std::string category;
     std::string severity;
+    std::string dllName;
 };
 
 class PEParser {

src/pe_parser.cpp

@@ -525,7 +525,8 @@ bool PEParser::parseImports() {
             suspiciousApiReports.push_back({
                 function,
                 category,
-                severity
+                severity,
+                dllName
             });
 
             std::cout << "    -> \033[33m[INCELE] ["
@@ -812,6 +813,8 @@ bool PEParser::exportTextReport() const {
         for (const auto& api : suspiciousApiReports) {
             report
                 << api.apiName
+                << " | DLL: "
+                << api.dllName
                 << " | Category: "
                 << api.category
                 << " | Severity: "
@@ -824,10 +827,12 @@ bool PEParser::exportTextReport() const {
 
     std::map<std::string, std::size_t> categoryCounts;
     std::map<std::string, std::size_t> severityCounts;
+    std::map<std::string, std::size_t> suspiciousDllCounts;
 
     for (const auto& api : suspiciousApiReports) {
         ++categoryCounts[api.category];
         ++severityCounts[api.severity];
+        ++suspiciousDllCounts[api.dllName];
     }
 
     report
@@ -866,6 +871,24 @@ bool PEParser::exportTextReport() const {
         report << "\n";
     }
 
+    report
+        << "Suspicious DLL Summary\n";
+
+    if (suspiciousDllCounts.empty()) {
+        report
+            << "No suspicious DLLs found.\n\n";
+    } else {
+        for (const auto& [dllName, count] : suspiciousDllCounts) {
+            report
+                << dllName
+                << ": "
+                << count
+                << "\n";
+        }
+
+        report << "\n";
+    }
+
     report
         << "Overall Risk\n"
         << "Risk Score: "
@@ -930,6 +953,7 @@ bool PEParser::exportJsonReport() const {
     std::map<std::string, std::size_t> sectionRiskCounts;
     std::map<std::string, std::size_t> categoryCounts;
     std::map<std::string, std::size_t> severityCounts;
+    std::map<std::string, std::size_t> suspiciousDllCounts;
 
     for (const auto& section : sectionReports) {
         ++sectionRiskCounts[section.risk];
@@ -938,6 +962,7 @@ bool PEParser::exportJsonReport() const {
     for (const auto& api : suspiciousApiReports) {
         ++categoryCounts[api.category];
         ++severityCounts[api.severity];
+        ++suspiciousDllCounts[api.dllName];
     }
 
     const int staticRiskScore =
@@ -1061,6 +1086,9 @@ bool PEParser::exportJsonReport() const {
             << "      \"api\": \""
             << escapeJsonString(api.apiName)
             << "\",\n"
+            << "      \"dll\": \""
+            << escapeJsonString(api.dllName)
+            << "\",\n"
             << "      \"category\": \""
             << escapeJsonString(api.category)
             << "\",\n"
@@ -1116,6 +1144,28 @@ bool PEParser::exportJsonReport() const {
         ++riskIndex;
     }
 
+    report
+        << "    },\n"
+        << "    \"suspiciousDlls\": {\n";
+
+    std::size_t suspiciousDllIndex = 0;
+
+    for (const auto& [dllName, count] : suspiciousDllCounts) {
+        report
+            << "      \""
+            << escapeJsonString(dllName)
+            << "\": "
+            << count;
+
+        if (suspiciousDllIndex + 1 <
+            suspiciousDllCounts.size()) {
+            report << ",";
+        }
+
+        report << "\n";
+        ++suspiciousDllIndex;
+    }
+
     report
         << "    },\n"
         << "    \"categories\": {\n";