aboutsummaryrefslogtreecommitdiffstats
path: root/framework/src/suricata/contrib/file_processor/Processor/Malwr.pm
blob: b8428c1e9048b796d53e2645664367d5f246f77f (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
package Processor::Malwr;
use Moose;
extends 'Processor';
use Data::Dumper;
use LWP::UserAgent;

has 'md5' => (is => 'ro', isa => 'Str', required => 1);
has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://malwr.com/analysis/%s/');
sub name { 'Malwr' }
sub description { 'Processor for Malwr.com' }

sub process {
	my $self = shift;
	my $url = sprintf($self->url_template, $self->md5);
	$self->log->debug('Getting url ' . $url);
	my $response = $self->ua->get($url);
	if ($response->code eq 200){
		if ($response->decoded_content =~ /Cannot find analysis with specified ID or MD5/){
			$self->log->debug('No result');
			return 0;
		}
		$self->log->info('Got malwr.com result');
		return $url;
	}
	else {
		$self->log->debug('Communications failure: ' . Dumper($response));
		return 0;
	}
}

1