malware_bazaar.py

import requests, json

from assemblyline_v4_service.common.base import ServiceBase
from assemblyline_v4_service.common.result import Result, ResultSection, BODY_FORMAT


class MalwareBazaarClient():
	def __init__(self, apikey=""):
		self.apikey = apikey
		self.headers = { "API-KEY": self.apikey }

	def get_infos(self, sha256):
		req = {
			"query": "get_info",
			"hash": sha256
		}

		s = requests.post("https://mb-api.abuse.ch/api/v1/", data=req, headers=self.headers)

		if s.status_code == 200 and s.json()["query_status"] != "hash_not_found":
			return s.json()["data"][0]


class MalwareBazaar(ServiceBase):
		def __init__(self, config=None):
			super(MalwareBazaar, self).__init__(config)

		def start(self):
			self.log.debug("Malware Bazaar service started")

		def stop(self):
			self.log.debug("Malware Bazaar service ended")

		def remove_empty_values(self, dict_to_clean):
			temp = {}

			for key in dict_to_clean:
				if dict_to_clean[key]:
					temp[key] = dict_to_clean[key]

			return temp

		def parse_special_vendor_dict(self, vendor_dict, name):
			i = 0
			temp = {}
			for res in vendor_dict:
				temp[name + " - " + str(i)] = res

			return temp

		def get_sub_dict(self, api_result, sub_name):
			try:
				sub_dict = api_result.pop(sub_name)
				sub_dict = self.remove_empty_values(sub_dict)
				return sub_dict
			except KeyError:
				return None

		def execute(self, request):
			result = Result()
			sha256 = request.sha256
			api_key = request.get_param("api_key")

			client = MalwareBazaarClient(api_key)
			api_result = client.get_infos(sha256)

			if api_result:
				# Removing the redundant informations in the report
				api_result.pop("yara_rules")
				api_result.pop("file_information")

				# Formatting the intel result to make it enjoyable
				intelligence = api_result.pop("intelligence")
				for key in intelligence:
						api_result["Intelligence - " + key] = intelligence[key]

				# Formatting the vendor intel result to make it better
				vendor_intel = api_result.pop("vendor_intel")
				for key in vendor_intel:
						api_result["Vendor intel - " + key] = vendor_intel[key]

				cert_pl_mwdb = self.get_sub_dict(api_result, "Vendor intel - CERT-PL_MWDB")
				yoroi_yomi = self.get_sub_dict(api_result, "Vendor intel - YOROI_YOMI")
				cape = self.get_sub_dict(api_result, "Vendor intel - CAPE")
				reversing_labs = self.get_sub_dict(api_result, "Vendor intel - ReversingLabs")
				doc_guard = self.get_sub_dict(api_result, "Vendor intel - DocGuard")

				try:
					ole_info = self.get_sub_dict(api_result, "ole_information")["oleid"]
				except (TypeError, KeyError):
					ole_info = None

				try:
					any_run = api_result.pop("Vendor intel - ANY.RUN")
					any_run = self.parse_special_vendor_dict(any_run, "Vendor intel - ANY.RUN")
					any_run = self.remove_empty_values(any_run)
				except KeyError:
					any_run = None

				try:
					spamhaus_hbl = api_result.pop("Vendor intel - Spamhaus_HBL")
					spamhaus_hbl = self.parse_special_vendor_dict(spamhaus_hbl, "Vendor intel - Spamhaus_HBL")
				except KeyError:
					spamhaus_hbl = None

				try:
					unpacme = api_result.pop("Vendor intel - UnpacMe")
					unpacme = self.parse_special_vendor_dict(unpacme, "Vendor intel - UnpacMe")
					unpacme = self.remove_empty_values(unpacme)
				except KeyError:
					unpacme = None

				try:
					vx_cube = api_result.pop("Vendor intel - vxCube")
					vx_cube_behaviour = vx_cube.pop("behaviour")
					vx_cube["threat_level"] = []
					vx_cube["rule"] = []
					for behaviour in vx_cube_behaviour:
						vx_cube["threat_level"].append(behaviour["threat_level"])
						vx_cube["rule"].append(behaviour["rule"])
				except KeyError:
					vx_cube = None

				try:
					inquest = api_result.pop("Vendor intel - InQuest")
					inquest_details = inquest.pop("details")
					inquest = self.remove_empty_values(inquest)
				except KeyError:
					inquest = None

				try:
					triage = api_result.pop("Vendor intel - Triage")
					triage = self.remove_empty_values(triage)
					triage_signatures = triage.pop("signatures")
					triage["signature"] = []
					triage["score"] = []
					for signature in triage_signatures:
						triage["signature"].append(signature["signature"])
						triage["score"].append(signature["score"])
					triage = self.remove_empty_values(triage)
				except KeyError:
					triage = None

				# Removing empty keys
				api_result = self.remove_empty_values(api_result)

				main_kv_section = ResultSection("Malware Bazaar analysis report", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(api_result))
				main_kv_section.set_heuristic(1)

				if ole_info:
					ResultSection("Ole Informations", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(ole_info), parent=main_kv_section)
				if cert_pl_mwdb:
					ResultSection("Vendor intel - CERT-PL_MWDB", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(cert_pl_mwdb), parent=main_kv_section)
				if yoroi_yomi:
					ResultSection("Vendor intel - YOROI_YOMI", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(yoroi_yomi), parent=main_kv_section)
				if cape:
					ResultSection("Vendor intel - CAPE", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(cape), parent=main_kv_section)
				if reversing_labs:
					ResultSection("Vendor intel - ReversingLabs", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(reversing_labs), parent=main_kv_section)
				if vx_cube:
					ResultSection("Vendor intel - vxCube", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(vx_cube), parent=main_kv_section)
				if inquest:
					inquest_kv_section = ResultSection("Vendor intel - InQuest", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(inquest), parent=main_kv_section)
					i = 0
					for detail in inquest_details:
						ResultSection("Details " + str(i), body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(detail), parent=inquest_kv_section)
						i += 1
				if triage:
					ResultSection("Vendor intel - Triage", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(triage), parent=main_kv_section)
				if doc_guard:
					ResultSection("Vendor intel - DocGuard", body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(doc_guard), parent=main_kv_section)
				if any_run:
					for key in any_run:
						ResultSection(key, body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(any_run[key]), parent=main_kv_section)
				if spamhaus_hbl:
					for key in spamhaus_hbl:
						ResultSection(key, body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(spamhaus_hbl[key]), parent=main_kv_section)
				if unpacme:
					for key in unpacme:
						ResultSection(key, body_format=BODY_FORMAT.KEY_VALUE, body=json.dumps(unpacme[key]), parent=main_kv_section)

				result.add_section(main_kv_section)

			request.result = result