Class: Shadowserver::Malware

Inherits:
Object
  • Object
show all
Defined in:
lib/shadowserver/malware.rb

Class Method Summary collapse

Class Method Details

._get(url) ⇒ Object 



58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/shadowserver/malware.rb', line 58

def  Malware::_get(url)
	url = URI.parse(url)
	request = Net::HTTP::Get.new(url.path+"?"+url.query)
	request.add_field("User-Agent", "Ruby/#{RUBY_VERSION} shadowserver rubygem (https://github.com/chrislee35/shadowserver)")
	http = Net::HTTP.new(url.host, url.port)
	if url.scheme == 'https'
		http.use_ssl = true
		http.verify_mode = OpenSSL::SSL::VERIFY_NONE
		http.verify_depth = 5
	end
	resp = http.request(request)
	resp.body
end

.avresult(hash) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
 
# File 'lib/shadowserver/malware.rb', line 37

def Malware::avresult(hash)
	doc = _get("http://innocuous.shadowserver.org/api/?avresult=#{hash}")
	raise doc.chomp if doc =~ /\! The Shadowserver Foundation:  RESTRICTED ACCESS/
	return nil if doc =~ /^\! The Shadowserver Foundation:/
	results = {}
	doc.split(/\n/).each do |l|
		next if l =~ /^"name","classification"/
		name, classification = l.gsub(/"/,'').split(/,/,2)
		results[name] = classification
	end
	results
end

.download(hash, filename = nil) ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/shadowserver/malware.rb', line 25

def Malware::download(hash,filename=nil)
	doc = _get("https://innocuous.shadowserver.org/api/?download=#{hash}")
	raise doc.chomp if doc =~ /\! The Shadowserver Foundation:  RESTRICTED ACCESS/
	return nil if doc =~ /^\! The Shadowserver Foundation:/
	if filename
		File.open(filename,"w") do |f|
			f.write(doc)
		end
	end
	doc
end

.query(hash) ⇒ Object 



8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/shadowserver/malware.rb', line 8

def Malware::query(hash)
	doc = _get("http://innocuous.shadowserver.org/api/?query=#{hash}")
	return nil if doc =~ /^\!/
	lines = doc.split(/\n/)
	md5, sha1, first_seen, last_seen, filetype, ssdeep = lines[0].gsub(/\"/,'').split(/,/)
	avresults = JSON.parse(lines[1])
	{
		"md5" => md5,
		"sha1" => sha1,
		"first_seen" => first_seen,
		"last_seen" => last_seen,
		"filetype" => filetype,
		"ssdeep" => ssdeep,
		"avresults" => avresults
	}
end

.ssdeep(hash) ⇒ Object 



50
51
52
53
54
55
 
# File 'lib/shadowserver/malware.rb', line 50

def Malware::ssdeep(hash)
	doc = _get("http://innocuous.shadowserver.org/api/?ssdeep=#{hash}")
	raise doc.chomp if doc =~ /\! The Shadowserver Foundation:  RESTRICTED ACCESS/
	return nil if doc =~ /^\! The Shadowserver Foundation:/
	doc.split(/\n/)
end