"""
Malware Signature Testing - EICAR Test Files
"""

# EICAR Standard Antivirus Test File
# This is a harmless test string used to verify antivirus detection
# Real antivirus products will flag this, but it's not actually malicious
EICAR_TEST = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*"

# Suspicious patterns often found in malware
def suspicious_pattern_1():
    """Pattern that looks like registry modification"""
    registry_path = r"HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
    return registry_path

def suspicious_pattern_2():
    """Pattern suggesting encoded payload"""
    encoded_payload = "UEsDBBQABgAIAAAAIQA"
    return encoded_payload

def suspicious_pattern_3():
    """Pattern suggesting process injection"""
    import ctypes
    kernel32 = ctypes.windll.kernel32
    return kernel32

def suspicious_pattern_4():
    """Pattern suggesting DLL injection"""
    def inject_dll(process_id, dll_path):
        import ctypes
        # Suspicious DLL injection pattern
        return process_id

def suspicious_pattern_5():
    """Pattern suggesting network callback"""
    def connect_to_c2():
        import socket
        sock = socket.socket()
        sock.connect(("suspicious-domain.com", 4444))
        return sock

def suspicious_pattern_6():
    """Pattern suggesting file system evasion"""
    import os
    def hide_file(filepath):
        import subprocess
        # Suspicious file hiding attempt
        subprocess.run(["attrib", "+h", filepath])
