suricata checkin based on commit id a4bce14770beee46a537eda3c3f6e8e8565d5d0a

Change-Id: I9a214fa0ee95e58fc640e50bd604dac7f42db48f

6 files changed, 188 insertions, 0 deletions

diff --git a/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm b/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm
new file mode 100644
index 00000000..6cdabb8d
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm
@@ -0,0 +1,33 @@
+package Processor::Anubis;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://anubis.iseclab.org/?action=result&task_id=%s');
+sub name { 'Anubis' }
+sub description { 'Processor for anubis.iseclab.org' }
+
+sub process {
+	my $self = shift;
+	my $url = sprintf($self->url_template, $self->md5);
+	$self->log->debug('Getting url ' . $url);
+	my $response = $self->ua->get($url);
+	#$self->log->debug(Dumper($response));
+	if ($response->code eq 200){
+		if ($response->decoded_content =~ /Invalid Task ID/){
+			$self->log->debug('No result');
+			return 0;
+		}
+		$self->log->info('Got result');
+		return $url;
+	}
+	else {
+		$self->log->debug('Communications failure: ' . Dumper($response));
+		return 0;
+	}
+}
+
+1
\ No newline at end of file
diff --git a/framework/src/suricata/contrib/file_processor/Processor/Makefile.am b/framework/src/suricata/contrib/file_processor/Processor/Makefile.am
new file mode 100644
index 00000000..a9a2fef8
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/Makefile.am
@@ -0,0 +1,2 @@
+EXTRA_DIST=Anubis.pm  Malwr.pm  ShadowServer.pm  ThreatExpert.pm  VirusTotal.pm
+
diff --git a/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm b/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm
new file mode 100644
index 00000000..b8428c1e
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm
@@ -0,0 +1,32 @@
+package Processor::Malwr;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://malwr.com/analysis/%s/');
+sub name { 'Malwr' }
+sub description { 'Processor for Malwr.com' }
+
+sub process {
+	my $self = shift;
+	my $url = sprintf($self->url_template, $self->md5);
+	$self->log->debug('Getting url ' . $url);
+	my $response = $self->ua->get($url);
+	if ($response->code eq 200){
+		if ($response->decoded_content =~ /Cannot find analysis with specified ID or MD5/){
+			$self->log->debug('No result');
+			return 0;
+		}
+		$self->log->info('Got malwr.com result');
+		return $url;
+	}
+	else {
+		$self->log->debug('Communications failure: ' . Dumper($response));
+		return 0;
+	}
+}
+
+1
\ No newline at end of file
diff --git a/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm b/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm
new file mode 100644
index 00000000..c9c7a5f9
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm
@@ -0,0 +1,49 @@
+package Processor::ShadowServer;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+use JSON;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://innocuous.shadowserver.org/api/?query=%s');
+sub name { 'ShadowServer' }
+sub description { 'Processor for shadowserver.com' }
+
+sub process {
+	my $self = shift;
+	my $url = sprintf($self->url_template, $self->md5);
+	$self->log->debug('Getting url ' . $url);
+	my $response = $self->ua->get($url);
+	if ($response->code eq 200){
+		if ($response->decoded_content =~ /No match/){
+			$self->log->debug('No result');
+			return 0;
+		}
+		elsif ($response->decoded_content =~ /Whitelisted/){
+			$self->log->info('Whitelisted');
+			return 0;
+		}
+		$self->log->info('Got shadowserver.com result');
+		my $ret;
+		eval {
+			my ($meta,$json) = split(/\n/, $response->decoded_content);
+			my @meta_cols = qw(md5 sha1 first_date last_date type ssdeep);
+			my %metas;
+			@metas{@meta_cols} = split(/\,/, $meta);
+			$ret = { meta => \%metas, results => decode_json($json) };
+		};
+		if ($@){
+			$self->log->error($@);
+			return 0;
+		}
+		return $ret;
+	}
+	else {
+		$self->log->debug('Communications failure: ' . Dumper($response));
+		return 0;
+	}
+}
+
+1
diff --git a/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm b/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm
new file mode 100644
index 00000000..b61fb0fc
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm
@@ -0,0 +1,33 @@
+package Processor::ThreatExpert;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://www.threatexpert.com/report.aspx?md5=%s');
+sub name { 'ThreatExpert' }
+sub description { 'Processor for threatexpert.com' }
+
+sub process {
+	my $self = shift;
+	my $url = sprintf($self->url_template, $self->md5);
+	$self->log->debug('Getting url ' . $url);
+	my $response = $self->ua->get($url);
+	#$self->log->debug(Dumper($response));
+	if ($response->code eq 200){
+		if ($response->decoded_content =~ /Search All Reports/){
+			$self->log->debug('No result');
+			return 0;
+		}
+		$self->log->info('Got result');
+		return $url;
+	}
+	else {
+		$self->log->debug('Communications failure: ' . Dumper($response));
+		return 0;
+	}
+}
+
+1
\ No newline at end of file
diff --git a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm
new file mode 100644
index 00000000..91a9939e
--- /dev/null
+++ b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm
@@ -0,0 +1,39 @@
+package Processor::VirusTotal;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url' => (is => 'ro', isa => 'Str', required => 1, default => 'https://www.virustotal.com/vtapi/v2/file/report');
+sub name { 'VirusTotal' }
+sub description { 'Processor for virustotal.com' }
+
+sub process {
+	my $self = shift;
+	unless ($self->conf->{virustotal_apikey}){
+		warn('No VirusTotal apikey configured in config file');
+		return 0;
+	}
+	$self->log->debug('Getting url ' . $self->url);
+	#$self->log->debug('md5: ' . $self->md5 . ', apikey: ' . $self->conf->{virustotal_apikey});
+	my $response = $self->ua->post($self->url, { resource => $self->md5, apikey => $self->conf->{virustotal_apikey} });
+	#$self->log->debug(Dumper($response));
+	if ($response->code eq 200){
+		my $data = $self->json->decode($response->decoded_content);
+		$self->log->debug('data: ' . Dumper($data));
+		if ($data->{positives}){
+			return $data;
+		}
+		else {
+			return 0;
+		}
+	}
+	else {
+		$self->log->debug('Communications failure: ' . Dumper($response));
+		return 0;
+	}
+}
+
+1
\ No newline at end of file