/**
 * Malware Detection Module for JavaScript/TypeScript
 * Detects various types of malicious code patterns
 *
 * Inspired by YARA rules and malware analysis techniques
 */
import { Severity, ThreatType } from '../../types';
/**
 * Malware detection result
 */
export interface MalwareMatch {
    /** Type of malware detected */
    type: MalwareType;
    /** Name of the detection */
    name: string;
    /** Description of the threat */
    description: string;
    /** Severity level */
    severity: Severity;
    /** Line number */
    line: number;
    /** Matched code snippet */
    code: string;
    /** Detection confidence 0-100 */
    confidence: number;
    /** Indicators of compromise */
    indicators: string[];
    /** MITRE ATT&CK references */
    mitreAttack?: string[];
    /** Remediation advice */
    remediation: string;
}
/**
 * Types of malware
 */
export declare enum MalwareType {
    STEALER = "stealer",
    KEYLOGGER = "keylogger",
    CREDENTIAL_HARVESTER = "credential_harvester",
    CRYPTOMINER = "cryptominer",
    CRYPTO_WALLET_STEALER = "crypto_wallet_stealer",
    BACKDOOR = "backdoor",
    REVERSE_SHELL = "reverse_shell",
    C2_COMMUNICATION = "c2_communication",
    DROPPER = "dropper",
    LOADER = "loader",
    OBFUSCATED_PAYLOAD = "obfuscated_payload",
    ENCODED_PAYLOAD = "encoded_payload",
    TYPOSQUAT = "typosquat",
    DEPENDENCY_CONFUSION = "dependency_confusion",
    POSTINSTALL_MALWARE = "postinstall_malware",
    ANTI_DEBUGGING = "anti_debugging",
    VM_DETECTION = "vm_detection",
    SANDBOX_EVASION = "sandbox_evasion",
    PERSISTENCE = "persistence",
    SUSPICIOUS_BEHAVIOR = "suspicious_behavior"
}
/**
 * Malware Detector Class
 */
export declare class MalwareDetector {
    private matches;
    private lines;
    /**
     * Scan code for malware patterns
     */
    scan(content: string, filePath: string): MalwareMatch[];
    /**
     * Run all malware pattern checks
     */
    private runPatternMatching;
    /**
     * Check for suspicious encoded strings
     */
    private checkEncodedStrings;
    /**
     * Check for high entropy content (encrypted/compressed data)
     */
    private checkHighEntropyContent;
    /**
     * Check for suspicious URLs
     */
    private checkSuspiciousUrls;
    /**
     * Get line number from string index
     */
    private getLineNumber;
    /**
     * Get code snippet for a line
     */
    private getCodeSnippet;
    /**
     * Remove duplicate matches
     */
    private deduplicateMatches;
    /**
     * Get threat type for malware type
     */
    static getThreatType(type: MalwareType): ThreatType;
}
export default MalwareDetector;
//# sourceMappingURL=malwareDetector.d.ts.map