drsemu_detection.lua

-- json = require "json"
utils = require "utils"

-- detection logic
function check(report_directory)

    local status = "CLEAN"

    -- open the first JSON file and read content
    local first_dynamic = utils.get_first_process_json(report_directory)
    local first_static = utils.get_first_static(report_directory)

-- 
--  your code starts from here
-- 
    -- static information
    local is_x86 = false
    if first_static ~= nil then
        is_x86 = first_static.generic.is_x86
    end

    -- dynamic information
    if first_dynamic ~= nil then
        -- enumerate json
        for index, win_func in pairs(first_dynamic) do

            -- Get information from a syscall, e.g. NtCreateUserProcess
            if win_func.NtCreateUserProcess then

                if win_func.NtCreateUserProcess.before.image_path ~= nil then
                    if win_func.NtCreateUserProcess.before.image_path:find("drsemu_eicar%.exe") then
                        return "WIN32.EICAR.DR"
                    end
                end

            end
        end
    end
    
    return status
end