diff options
author | 2015-09-09 22:21:41 -0700 | |
---|---|---|
committer | 2015-09-09 22:21:41 -0700 | |
commit | 8879b125d26e8db1a5633de5a9c692eb2d1c4f83 (patch) | |
tree | c7259d85a991b83dfa85ab2e339360669fc1f58e /framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm | |
parent | 13d05bc8458758ee39cb829098241e89616717ee (diff) |
suricata checkin based on commit id a4bce14770beee46a537eda3c3f6e8e8565d5d0a
Change-Id: I9a214fa0ee95e58fc640e50bd604dac7f42db48f
Diffstat (limited to 'framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm')
-rw-r--r-- | framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm new file mode 100644 index 00000000..91a9939e --- /dev/null +++ b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm @@ -0,0 +1,39 @@ +package Processor::VirusTotal; +use Moose; +extends 'Processor'; +use Data::Dumper; +use LWP::UserAgent; + +has 'md5' => (is => 'ro', isa => 'Str', required => 1); +has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); +has 'url' => (is => 'ro', isa => 'Str', required => 1, default => 'https://www.virustotal.com/vtapi/v2/file/report'); +sub name { 'VirusTotal' } +sub description { 'Processor for virustotal.com' } + +sub process { + my $self = shift; + unless ($self->conf->{virustotal_apikey}){ + warn('No VirusTotal apikey configured in config file'); + return 0; + } + $self->log->debug('Getting url ' . $self->url); + #$self->log->debug('md5: ' . $self->md5 . ', apikey: ' . $self->conf->{virustotal_apikey}); + my $response = $self->ua->post($self->url, { resource => $self->md5, apikey => $self->conf->{virustotal_apikey} }); + #$self->log->debug(Dumper($response)); + if ($response->code eq 200){ + my $data = $self->json->decode($response->decoded_content); + $self->log->debug('data: ' . Dumper($data)); + if ($data->{positives}){ + return $data; + } + else { + return 0; + } + } + else { + $self->log->debug('Communications failure: ' . Dumper($response)); + return 0; + } +} + +1
\ No newline at end of file |