send HTTP request

[mike-hunhoff]

file: https://www.virustotal.com/gui/file/18fccc911770c26135feb4837cc40920c798c57bc062cbdfb29641a891720938

Function Address	Capability	Verdict (TP/FP)	Evidence & Reasoning	Suggested Fix
0x409052	send HTTP request	❌ FP	The function constructs and sends strings like HTTP/1.0 404 Host Not Found and HTTP/1.0 400 Malformed Request. This indicates the malware is acting as an HTTP Server sending a Response, not a Client sending a Request.	Inspect buffer for HTTP Method verbs (GET, POST) for requests, distinct from Status Codes (404, 200) for responses.

[saniyafatima07]

Hello @mike-hunhoff,
I’m interested in working on this issue and would like to contribute a fix.
Could you please assign it to me?

[mike-hunhoff]

Done - let us know if you have any questions 🙂

[saniyafatima07]

Sure @mike-hunhoff
Thank you for assigning the issue.

[saniyafatima07]

@mike-hunhoff

From my understanding of this issue, the false positive occurs because the malware is actually sending an HTTP server response, while capa is detecting it as an HTTP client request due to the very generic /HTTP/i string match. The main goal here is to reduce this false positive and more accurately distinguish real HTTP client requests from other HTTP-related traffic.

While looking into this, I followed the suggestion of matching explicit HTTP request methods. Since HTTP client requests sent over raw sockets typically start with methods like GET or POST, I replaced the generic HTTP string match with specific method strings.

I chose to use literal string matches instead of a regex-based approach to keep the rule simple and efficient, as regex matching can be slightly more expensive as mentioned in the documentation.

I am not entirely sure if this is the exact behavior expected, but this approach should reduce false positives while still reliably detecting HTTP client requests.

Please let me know if this aligns with the intended fix or if you’d prefer a different approach

[mike-hunhoff]

Let's move our discussion to your PR 🙂