BRO :: ShadowServer Sandbox API Status Query

shadowserver-mhr.bro

##! see http://www.shadowserver.org/wiki/pmwiki.php/Services/Sandboxapi
#
# ShadowServer Sandbox API Status Query
# http://innocuous.shadowserver.org/api/?query=#md5-or-sha1# 
# Returns the md5, sha1, first seen date (UTC), last seen date (UTC), file type, and ssdeep hash 
# on the first line as a CSV value. The second line is a JSON object containing antivirus vendor 
# and signature details for the given sample.


@load base/frameworks/files
@load base/frameworks/notice
@load frameworks/files/hash-all-files

module ShadowServerMalwareHash;

export {
    redef enum Notice::Type += {
        Match
    };

    ## File types to attempt matching 
    const match_file_types = /application\/x-dosexec/ |
                             /application\/vnd.ms-cab-compressed/ |
                             /application\/pdf/ |
                             /application\/x-shockwave-flash/ |
                             /application\/x-java-applet/ |
                             /application\/jar/  &redef;

    const url = "http://innocuous.shadowserver.org/api/?query" &redef;

}


# keep list of checked & matched
global checked_hashes: set[string] &synchronized;
global matched_hashes: set[string] &synchronized;

function do_lookup(hash: string, fi: Notice::FileInfo)
    {
        local _url = fmt("%s=%s", url, hash);
        local req: ActiveHTTP::Request = ActiveHTTP::Request($url=_url);
        when (local res = ActiveHTTP::request(req))
            {
                if ( |res| > 0)
                    {
                        local body = res$body;
                        #print body;
                        #"67291715c45c4594b8866e90fbf5c7c4","a86dcb1d04be68a9f2d2373ee55cbe15fd299452","2014-11-06 16:15:51","2014-11-12 16:28:05","exe",""{"AVG":"Crypt2.AFKG","AVG":"Inject2.BDIT","Avira":"TR/Injector.139264.29","BitDefender":"Trojan.GenericKD.1961906","Comodo":".UnclassifiedMalware","Eset":"Win32/Injector.BOVZ","K7":"Trojan ( 004b065c1 )","Lionic":"Troj.W32.Gen","McAfee":"Artemis!67291715C45C","Norman":"winpe/Injector.HKVF","Symantec":"Suspicious.Insight","Symantec":"WS.Reputation.1"}
                        # why \\n does not work for split ?
                        local tmp = split1(body, /\{/);
                        if ( |tmp| == 2 )
                            {
                                # put { back
                                local av_list = fmt("{%s",tmp[2]);
                                local stuff = split(tmp[1],/,/);
                                #print stuff;
                                #[2] = "a86dcb1d04be68a9f2d2373ee55cbe15fd299452",
                                #[6] = "",
                                #[4] = "2014-11-12 16:28:05",
                                #[1] = "67291715c45c4594b8866e90fbf5c7c4",
                                #[3] = "2014-11-06 16:15:51",
                                #[5] = "exe"
                                local first_time = stuff[3];
                                local last_time = stuff[4];
                                local n: Notice::Info = Notice::Info($note=Match, $msg=first_time,  $sub=av_list);
                                Notice::populate_file_info2(fi, n);
                                NOTICE(n);
                                add(matched_hashes[hash]);
                            }
                        
                    }
            }
    }

event file_hash(f: fa_file, kind: string, hash: string)
    {
    if ( kind == "sha1" && f?$mime_type && match_file_types in f$mime_type )
        if ( ! ( hash in checked_hashes ) )
            {
                add(checked_hashes[hash]);
                do_lookup(hash, Notice::create_file_info(f));
            }
        else 
            {
                if ( hash in matched_hashes )
                    {
                        local n: Notice::Info = Notice::Info($note=Match, $msg="already seen before");
                        Notice::populate_file_info2(Notice::create_file_info(f), n);
                        NOTICE(n);
                    }
            }
    }