Skip to content

Commit 0ad2263

Browse files
garanewsgaranews
authored
Merge pull request #728 from TheHive-Project/feature/malwarebazaar
malwarebazaar hash search
2 parents 99337a4 + 06cf81e commit 0ad2263

File tree

5 files changed

+201
-0
lines changed

5 files changed

+201
-0
lines changed

‎analyzers/MalwareBazaar/MalwareBazaar.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"name": "MalwareBazaar",
3+
"author": "Andrea Garavaglia, Davide Arcuri - LDO-CERT",
4+
"license": "AGPL-V3",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"version": "1.0",
7+
"baseConfig": "MalwareBazaar",
8+
"description": "Search hashes on MalwareBazaar.",
9+
"dataTypeList": ["domain", "fqdn", "url", "hash", "ip"],
10+
"command": "MalwareBazaar/MalwareBazaar_analyzer.py",
11+
"configurationItems": [ {
12+
"name": "api_key",
13+
"description": "MalwareBazaar api key",
14+
"multi": false,
15+
"required": true,
16+
"type": "string"
17+
}
18+
]
19+
}

‎analyzers/MalwareBazaar/MalwareBazaar_analyzer.py‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
#!/usr/bin/env python3
2+
import requests
3+
from cortexutils.analyzer import Analyzer
4+
5+
BASEURL = 'https://mb-api.abuse.ch/api/v1/'
6+
7+
class MalwareBazaarAnalyzer(Analyzer):
8+
def __init__(self):
9+
Analyzer.__init__(self)
10+
self.api_key = self.get_param("config.api_key", None)
11+
12+
def run(self):
13+
data = self.get_data()
14+
if not data:
15+
self.error('No observable or file given.')
16+
17+
results = {}
18+
if self.data_type == 'hash':
19+
if len(data) in [32, 40, 64]:
20+
headers = { 'API-KEY': self.api_key }
21+
data = {
22+
'query': 'get_info',
23+
'hash': data,
24+
}
25+
results = requests.post(BASEURL, data=data, timeout=15, headers=headers)
26+
27+
if results.status_code == 200:
28+
results = results.json()
29+
if results['query_status'] in ['http_post_expected', 'illegal_hash', 'no_hash_provided']:
30+
self.error('MalwareBazaar returned error: %s' % results['query_status'])
31+
elif results['query_status'] != 'hash_not_found':
32+
results['data'] = results['data'][0]
33+
else:
34+
self.error('Only sha256, sha1 and md5 supported by MalwareBazaar.')
35+
else:
36+
self.error('Datatype not supported.')
37+
38+
self.report(results)
39+
40+
def summary(self, raw):
41+
taxonomies = []
42+
namespace = "MalwareBazaar"
43+
44+
if raw['query_status'] == 'hash_not_found':
45+
taxonomies.append(self.build_taxonomy(
46+
'info',
47+
namespace,
48+
'Search',
49+
'No results'
50+
))
51+
else:
52+
taxonomies.append(self.build_taxonomy(
53+
'malicious',
54+
namespace,
55+
'Signature',
56+
raw['data'].get('signature', 'Unknown')
57+
))
58+
return {"taxonomies": taxonomies}
59+
60+
61+
if __name__ == '__main__':
62+
MalwareBazaarAnalyzer().run()

‎analyzers/MalwareBazaar/requirements.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cortexutils
2+
requests

‎thehive-templates/MalwareBazaar_1_0/long.html‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
<div class="panel panel-info" ng-if="success && content.query_status == 'ok'">
2+
<div class="panel-heading">
3+
MalwareBazaar search results for
4+
<strong>{{artifact.data | fang}}</strong>
5+
</div>
6+
<div class="panel-body">
7+
<div>
8+
<dl class="dl-horizontal">
9+
<dt>Hashes</dt>
10+
<dd class="wrap">
11+
md5: {{content.data.md5_hash}}<br />
12+
sha256: {{content.data.sha256_hash}}<br />
13+
sha1: {{content.data.sha1_hash}}<br />
14+
imphash: {{content.data.imphash}}<br />
15+
ssdeep: {{content.data.ssdeep}}
16+
</dd>
17+
<dt>Reporter</dt>
18+
<dd>{{content.data.reporter}}</dd>
19+
<dt>First seen (UTC)</dt>
20+
<dd>{{content.data.first_seen}}</dd>
21+
<dt ng-if="content.data.last_seen">Last seen (UTC)</dt>
22+
<dd ng-if="content.data.last_seen">{{content.data.last_seen}}</dd>
23+
<dt>Filename</dt>
24+
<dd>{{content.data.file_name}}</dd>
25+
<dt>Filetype</dt>
26+
<dd>{{content.data.file_type}} {{content.data.file_type_mime}}</dd>
27+
<dt ng-if="content.data.delivery_method">Delivery Method</dt>
28+
<dd ng-if="content.data.delivery_method">{{content.data.delivery_method}}</dd>
29+
<dt>Signature</dt>
30+
<dd><span class="label label-primary">{{content.data.signature}}</span></dd>
31+
<dt>Tags</dt>
32+
<dd><span ng-repeat="tag in content.data.tags" class="label label-info">{{tag}}</span></dd>
33+
</dl>
34+
</div>
35+
</div>
36+
</div>
37+
<div class="panel panel-info" ng-if="success && content.data.intelligence">
38+
<div class="panel-heading">Intelligence</div>
39+
<div class="panel-body">
40+
<div>
41+
<dl class="dl-horizontal">
42+
<dt ng-if="content.data.intelligence.clamav">Clamav</dt>
43+
<dd ng-if="content.data.intelligence.clamav">{{content.data.intelligence.clamav}}</dd>
44+
45+
<dt ng-if="content.data.intelligence.downloads">Downloads</dt>
46+
<dd ng-if="content.data.intelligence.downloads">{{content.data.intelligence.downloads}}</dd>
47+
48+
<dt ng-if="content.data.intelligence.uploads">Uploads</dt>
49+
<dd ng-if="content.data.intelligence.uploads">{{content.data.intelligence.uploads}}</dd>
50+
51+
<dt ng-if="content.data.intelligence.mail">Mail</dt>
52+
<dd ng-if="content.data.intelligence.mail">
53+
<span ng-repeat="(k,v) in content.data.intelligence.mail">
54+
{{k}} > {{v}}<br/>
55+
</span>
56+
</dd>
57+
</dl>
58+
</div>
59+
</div>
60+
</div>
61+
62+
<div class="panel panel-info" ng-if="success && content.data.file_information">
63+
<div class="panel-heading">File Information</div>
64+
<div class="panel-body">
65+
<p ng-repeat="info in content.data.file_information">
66+
{{info.context}}: {{info.value}}
67+
</p>
68+
</div>
69+
</div>
70+
71+
<div class="panel panel-info" ng-if="success && content.data.comments">
72+
<div class="panel-heading">Comments</div>
73+
<div class="panel-body">
74+
<div>
75+
<dl class="dl-horizontal">
76+
<dt ng-repeat-start="comment in content.data.comments">{{comment.display_name}} - {{comment.date_added}}</dt>
77+
<dd ng-repeat-end>{{comment.comment}}</dd>
78+
<hr/>
79+
<hr/>
80+
<dt ng-if="content.data.comment">Comment</dt>
81+
<dd ng-if="content.data.comment">{{content.data.comment}}</dd>
82+
</dl>
83+
</div>
84+
</div>
85+
</div>
86+
87+
<!-- No results -->
88+
<div class="panel panel-danger" ng-if="content.query_status == 'hash_not_found'">
89+
<div class="panel-heading">
90+
<strong>{{artifact.data | fang}}</strong>
91+
</div>
92+
<div class="panel-body">
93+
<dl class="dl-horizontal">
94+
<dt>
95+
<i class="fa fa-warning"></i> MalwareBazaar:
96+
</dt>
97+
<dd class="wrap">No results</dd>
98+
</dl>
99+
</div>
100+
</div>
101+
102+
<!-- General error -->
103+
<div class="panel panel-danger" ng-if="!success">
104+
<div class="panel-heading">
105+
<strong>{{artifact.data | fang}}</strong>
106+
</div>
107+
<div class="panel-body">
108+
<dl class="dl-horizontal" ng-if="content.errorMessage">
109+
<dt>
110+
<i class="fa fa-warning"></i> MalwareBazaar:
111+
</dt>
112+
<dd class="wrap">{{content.errorMessage}}</dd>
113+
</dl>
114+
</div>
115+
</div>

‎thehive-templates/MalwareBazaar_1_0/short.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
2+
{{t.namespace}}:{{t.predicate}}="{{t.value}}"
3+
</span>

0 commit comments

Comments
 (0)