diff options
Diffstat (limited to 'framework/src/suricata/contrib/file_processor/Processor')
6 files changed, 0 insertions, 188 deletions
diff --git a/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm b/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm deleted file mode 100644 index 6cdabb8d..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Anubis.pm +++ /dev/null @@ -1,33 +0,0 @@ -package Processor::Anubis; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://anubis.iseclab.org/?action=result&task_id=%s'); -sub name { 'Anubis' } -sub description { 'Processor for anubis.iseclab.org' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Invalid Task ID/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/Makefile.am b/framework/src/suricata/contrib/file_processor/Processor/Makefile.am deleted file mode 100644 index a9a2fef8..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Makefile.am +++ /dev/null @@ -1,2 +0,0 @@ -EXTRA_DIST=Anubis.pm Malwr.pm ShadowServer.pm ThreatExpert.pm VirusTotal.pm - diff --git a/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm b/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm deleted file mode 100644 index b8428c1e..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm +++ /dev/null @@ -1,32 +0,0 @@ -package Processor::Malwr; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://malwr.com/analysis/%s/'); -sub name { 'Malwr' } -sub description { 'Processor for Malwr.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Cannot find analysis with specified ID or MD5/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got malwr.com result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm b/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm deleted file mode 100644 index c9c7a5f9..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/ShadowServer.pm +++ /dev/null @@ -1,49 +0,0 @@ -package Processor::ShadowServer; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; -use JSON; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://innocuous.shadowserver.org/api/?query=%s'); -sub name { 'ShadowServer' } -sub description { 'Processor for shadowserver.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - if ($response->code eq 200){ - if ($response->decoded_content =~ /No match/){ - $self->log->debug('No result'); - return 0; - } - elsif ($response->decoded_content =~ /Whitelisted/){ - $self->log->info('Whitelisted'); - return 0; - } - $self->log->info('Got shadowserver.com result'); - my $ret; - eval { - my ($meta,$json) = split(/\n/, $response->decoded_content); - my @meta_cols = qw(md5 sha1 first_date last_date type ssdeep); - my %metas; - @metas{@meta_cols} = split(/\,/, $meta); - $ret = { meta => \%metas, results => decode_json($json) }; - }; - if ($@){ - $self->log->error($@); - return 0; - } - return $ret; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1 diff --git a/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm b/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm deleted file mode 100644 index b61fb0fc..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/ThreatExpert.pm +++ /dev/null @@ -1,33 +0,0 @@ -package Processor::ThreatExpert; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://www.threatexpert.com/report.aspx?md5=%s'); -sub name { 'ThreatExpert' } -sub description { 'Processor for threatexpert.com' } - -sub process { - my $self = shift; - my $url = sprintf($self->url_template, $self->md5); - $self->log->debug('Getting url ' . $url); - my $response = $self->ua->get($url); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - if ($response->decoded_content =~ /Search All Reports/){ - $self->log->debug('No result'); - return 0; - } - $self->log->info('Got result'); - return $url; - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file diff --git a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm b/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm deleted file mode 100644 index 91a9939e..00000000 --- a/framework/src/suricata/contrib/file_processor/Processor/VirusTotal.pm +++ /dev/null @@ -1,39 +0,0 @@ -package Processor::VirusTotal; -use Moose; -extends 'Processor'; -use Data::Dumper; -use LWP::UserAgent; - -has 'md5' => (is => 'ro', isa => 'Str', required => 1); -has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); }); -has 'url' => (is => 'ro', isa => 'Str', required => 1, default => 'https://www.virustotal.com/vtapi/v2/file/report'); -sub name { 'VirusTotal' } -sub description { 'Processor for virustotal.com' } - -sub process { - my $self = shift; - unless ($self->conf->{virustotal_apikey}){ - warn('No VirusTotal apikey configured in config file'); - return 0; - } - $self->log->debug('Getting url ' . $self->url); - #$self->log->debug('md5: ' . $self->md5 . ', apikey: ' . $self->conf->{virustotal_apikey}); - my $response = $self->ua->post($self->url, { resource => $self->md5, apikey => $self->conf->{virustotal_apikey} }); - #$self->log->debug(Dumper($response)); - if ($response->code eq 200){ - my $data = $self->json->decode($response->decoded_content); - $self->log->debug('data: ' . Dumper($data)); - if ($data->{positives}){ - return $data; - } - else { - return 0; - } - } - else { - $self->log->debug('Communications failure: ' . Dumper($response)); - return 0; - } -} - -1
\ No newline at end of file |