Skip to content

Commit bf0ef9e

Browse files
awest1339awest1339
committed
Merge branch 'release/1.2.0'
2 parents eca9e2d + 3e89001 commit bf0ef9e

File tree

17 files changed

+849
-43
lines changed

17 files changed

+849
-43
lines changed

‎multiscanner.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
from __future__ import (absolute_import, division, print_function,
77
unicode_literals, with_statement)
88

9+
__version__ = '1.2.0'
10+
911
import codecs
1012
import configparser
1113
import datetime

‎requirements.txt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ requests
1515
ssdeep
1616
tika
1717
yara-python
18+
#Required for STIX2 content
19+
stix2
1820
#Required for PDF
1921
reportlab
2022
#Required by API

‎setup.cfg‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
[bumpversion]
2-
current_version = 1.1.1
2+
current_version = 1.2.0
33
commit = False
44
tag = False
55

6+
[bumpversion:file:multiscanner.py]
7+
68
[flake8]
79
ignore = E126,E127,E128,E402
810
max-line-length = 120
911
exclude = .git,__pycache__,libs/pdfparser.py,libs/office_meta.py
12+

‎setup.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ def recursive_dir_list(path, exclude=['.pyc', '__pycache__']):
2929

3030
setup(
3131
name='multiscanner',
32-
version='1.1.1',
32+
version='1.2.0',
3333
url='https://github.com/MITRECND/multiscanner',
3434
license='MPL 2.0',
3535
author='Drew Bonasera',
@@ -49,6 +49,8 @@ def recursive_dir_list(path, exclude=['.pyc', '__pycache__']):
4949
'python-magic',
5050
'requests',
5151
'ssdeep',
52+
# Required for STIX2 content
53+
'stix2',
5254
# Required by PDF
5355
'reportlab',
5456
# Required by API

‎storage/elasticsearch_storage.py‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ def get_report(self, sample_id, timestamp):
281281
}},
282282
{
283283
"term": {
284-
"Scan Time": ts
284+
"Scan Metadata.Scan Time": ts
285285
}
286286
}
287287
]
@@ -490,6 +490,24 @@ def delete(self, report_id):
490490
# TODO: log exception
491491
return False
492492

493+
def delete_by_task_id(self, task_id):
494+
query = {
495+
"query": {
496+
"term": {
497+
"Scan Metadata.Task ID": task_id
498+
}
499+
}
500+
}
501+
502+
try:
503+
self.es.delete_by_query(
504+
index=self.index, doc_type=self.doc_type, body=query
505+
)
506+
return True
507+
except Exception as e:
508+
# TODO: log exception
509+
return False
510+
493511
def teardown(self):
494512
pass
495513

‎tests/test_api.py‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -165,12 +165,6 @@ def test_get_updated_task(self):
165165
self.assertEqual(resp.status_code, api.HTTP_OK)
166166
self.assertDictEqual(json.loads(resp.get_data().decode()), expected_response)
167167

168-
def test_delete_nonexistent_task(self):
169-
expected_response = api.TASK_NOT_FOUND
170-
resp = self.app.delete('/api/v1/tasks/2')
171-
self.assertEqual(resp.status_code, api.HTTP_NOT_FOUND)
172-
self.assertDictEqual(json.loads(resp.get_data().decode()), expected_response)
173-
174168

175169
class TestTaskDeleteCase(APITestCase):
176170
def setUp(self):
@@ -179,13 +173,17 @@ def setUp(self):
179173
# populate the DB w/ a task
180174
post_file(self.app)
181175

182-
def test_delete_task(self):
176+
@mock.patch('api.handler')
177+
def test_delete_task(self, mock_handler):
178+
mock_handler.delete_by_task_id.return_value = True
183179
expected_response = {'Message': 'Deleted'}
184180
resp = self.app.delete('/api/v1/tasks/1')
185181
self.assertEqual(resp.status_code, api.HTTP_OK)
186182
self.assertDictEqual(json.loads(resp.get_data().decode()), expected_response)
187183

188-
def test_delete_nonexistent_task(self):
184+
@mock.patch('api.handler')
185+
def test_delete_nonexistent_task(self, mock_handler):
186+
mock_handler.delete_by_task_id.return_value = False
189187
expected_response = api.TASK_NOT_FOUND
190188
resp = self.app.delete('/api/v1/tasks/2')
191189
self.assertEqual(resp.status_code, api.HTTP_NOT_FOUND)

‎tests/test_elasticsearch.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ def test_get_report(self, mock_get, mock_search):
6666
args, kwargs = mock_search.call_args_list[0]
6767
self.assertEqual(kwargs['index'], ElasticSearchStorage.DEFAULTCONF['index'])
6868
self.assertEqual(kwargs['body']['query']['bool']['must'][0]['has_parent']['query']['term']['_id'], TEST_ID)
69-
self.assertEqual(kwargs['body']['query']['bool']['must'][1]['term']['Scan Time'], TEST_TS)
69+
self.assertEqual(kwargs['body']['query']['bool']['must'][1]['term']['Scan Metadata.Scan Time'], TEST_TS)
7070
self.assertEqual(kwargs['doc_type'], ElasticSearchStorage.DEFAULTCONF['doc_type'])
7171

7272
mock_get.assert_any_call(index=ElasticSearchStorage.DEFAULTCONF['index'], id=TEST_ID, doc_type='sample')

‎tests/utils/stix2_generator/sample_report.json‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
{
2+
"Report": {
3+
"Cuckoo Sandbox": {
4+
"dropped": [
5+
{
6+
"crc32": "EDB36492",
7+
"filepath": "C:\\Users\\some_user\\AppData\\Local\\Temp\\n2422\\s2429.exe.zip",
8+
"md5": "d659e8900ea3fabe425882debed0c494",
9+
"name": "1acf42374fb021fd_s2429.exe.zip",
10+
"path": "/opt/cuckoo/.cuckoo/storage/analyses/22605/files/1acf42374fb021fd_s2429.exe.zip",
11+
"pids": [
12+
2272
13+
],
14+
"sha1": "388e6816aff442e13cb546cfacd0c1d75b59b5b1",
15+
"sha256": "1acf42374fb021fd1172df27a06f72e0e59f69a0bfaaaaea56f28dff6af01110",
16+
"sha512": "f7e2de13afe330c96be43320968fc1152ef30562cd5e51a2b60306caffdea50745b1d515112cd09b0aaf1ba33c64bdd835d9999ec01f09aae8dbe01407d98e82",
17+
"size": 173228,
18+
"ssdeep": "3072:v8O0PPXlpAmOvDtu31DunkJdmAOIAT3B/WAyU98SJ4MWFYAkOymiTG4czJE:kdPP1Cm+OKYdmoqH8SSpkOye4czO",
19+
"type": "Zip archive data, at least v2.0 to extract"
20+
},
21+
{
22+
"crc32": "D29343CF",
23+
"filepath": "C:\\Users\\some_user\\AppData\\Local\\Temp\\n2422\\s2429.exe",
24+
"md5": "13b0085a03720e67fb8c73db3f14609e",
25+
"name": "f9449897f9ca99b9_s2429.exe",
26+
"path": "/opt/cuckoo/.cuckoo/storage/analyses/22605/files/f9449897f9ca99b9_s2429.exe",
27+
"pids": [
28+
2272
29+
],
30+
"sha1": "ddf811f21e6c066b644d03e6751e16efb0fbecce",
31+
"sha256": "f9449897f9ca99b99837ad322c8b6737e7a47e3827b6a4c073c6ca8911d8c340",
32+
"sha512": "39b95dce14b3eea6f191d4dbaaff87ebbc8f3b6982e7b4ee5ebeed83d3b7397441665f25dec5eb9f8a1f3b12f4ddcd604d5852b781f592488263161c0d620e82",
33+
"size": 421056,
34+
"ssdeep": "6144:63hJxWjDKn4yTxz12wj/CF6J2Os+WX+ugnZJFNpluJHA4:6RJWDsTxzIwj/CF6FR6+zcO4",
35+
"type": "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
36+
}
37+
],
38+
"signatures": [
39+
{
40+
"description": "This executable is signed",
41+
"name": "has_authenticode",
42+
"severity": 1
43+
},
44+
{
45+
"description": "Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available",
46+
"markcount": 1,
47+
"marks": [
48+
{
49+
"call": {
50+
"api": "GlobalMemoryStatusEx",
51+
"category": "system",
52+
"return_value": 1,
53+
"status": 1,
54+
"tid": 1156,
55+
"time": 1508411224.064626
56+
},
57+
"cid": 4115,
58+
"pid": 2272,
59+
"type": "call"
60+
}
61+
],
62+
"name": "antivm_memory_available",
63+
"severity": 1
64+
},
65+
{
66+
"description": "Potentially malicious URLs were found in the process memory dump",
67+
"markcount": 3,
68+
"marks": [
69+
{
70+
"category": "url",
71+
"description": null,
72+
"ioc": "http://ns.adobe.com/xap/1.0/mm/",
73+
"type": "ioc"
74+
},
75+
{
76+
"category": "url",
77+
"description": null,
78+
"ioc": "http://ns.adobe.com/xap/1.0/sType/ResourceRef",
79+
"type": "ioc"
80+
},
81+
{
82+
"category": "url",
83+
"description": null,
84+
"ioc": "http://ns.adobe.com/xap/1.0/",
85+
"type": "ioc"
86+
}
87+
],
88+
"name": "memdump_urls",
89+
"severity": 2
90+
},
91+
{
92+
"description": "Performs some HTTP requests",
93+
"markcount": 14,
94+
"marks": [
95+
{
96+
"category": "request",
97+
"description": null,
98+
"ioc": "GET http://www.msftncsi.com/ncsi.txt",
99+
"type": "ioc"
100+
},
101+
{
102+
"category": "request",
103+
"description": null,
104+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ec38990cc55170ab",
105+
"type": "ioc"
106+
},
107+
{
108+
"category": "request",
109+
"description": null,
110+
"ioc": "POST http://tools.google.com/service/update2?cup2key=6:2144477707&cup2hreq=a6c83ff1daef97153eb6f265f9181edc5cea9a80f527aea825c28f6307c1fdfc",
111+
"type": "ioc"
112+
},
113+
{
114+
"category": "request",
115+
"description": null,
116+
"ioc": "POST http://tools.google.com/service/update2?cup2key=6:3255292227&cup2hreq=a6c83ff1daef97153eb6f265f9181edc5cea9a80f527aea825c28f6307c1fdfc",
117+
"type": "ioc"
118+
},
119+
{
120+
"category": "request",
121+
"description": null,
122+
"ioc": "POST http://tools.google.com/service/update2?cup2key=6:1128284371&cup2hreq=a6c83ff1daef97153eb6f265f9181edc5cea9a80f527aea825c28f6307c1fdfc",
123+
"type": "ioc"
124+
},
125+
{
126+
"category": "request",
127+
"description": null,
128+
"ioc": "POST http://tools.google.com/service/update2?cup2key=6:1439439368&cup2hreq=a6c83ff1daef97153eb6f265f9181edc5cea9a80f527aea825c28f6307c1fdfc",
129+
"type": "ioc"
130+
},
131+
{
132+
"category": "request",
133+
"description": null,
134+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?075dc50dacf9f2bb",
135+
"type": "ioc"
136+
},
137+
{
138+
"category": "request",
139+
"description": null,
140+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?31308c2120fea4bc",
141+
"type": "ioc"
142+
},
143+
{
144+
"category": "request",
145+
"description": null,
146+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6ecb1b8de9d8006f",
147+
"type": "ioc"
148+
},
149+
{
150+
"category": "request",
151+
"description": null,
152+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?91c8a9092e8cb67a",
153+
"type": "ioc"
154+
},
155+
{
156+
"category": "request",
157+
"description": null,
158+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1390637153eb96bd",
159+
"type": "ioc"
160+
},
161+
{
162+
"category": "request",
163+
"description": null,
164+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b16bed41061b4861",
165+
"type": "ioc"
166+
},
167+
{
168+
"category": "request",
169+
"description": null,
170+
"ioc": "GET http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9a8ede518893069d",
171+
"type": "ioc"
172+
},
173+
{
174+
"category": "request",
175+
"description": null,
176+
"ioc": "GET http://go.microsoft.com/fwlink/?LinkId=544713",
177+
"type": "ioc"
178+
}
179+
],
180+
"name": "network_http",
181+
"severity": 2
182+
}
183+
]
184+
},
185+
"MD5": "34303fdb55e5d0f1142bb07eed2064cb",
186+
"SHA1": "91fd2d2935aedcb47271b54cd22f8fe3b30c17fd",
187+
"SHA256": "90b1e39282dbda2341d91b87ca161afe564b7d3b4f82f25b3f1dce3fa857226c"
188+
}
189+
}

0 commit comments

Comments
 (0)