def parseVTFile(dump, fullScan = False):
h = Hopper()
if dump["response_code"] == 0:
return h
add_info = dump["additional_info"]
impTblHash = add_info["pe-imphash"]
h.import_table_container[impTblHash].append("VT-import-table")
if fullScan == True:
out = pivotEngine.pivotVTFile(impTblHash, "imphash")
relatedHashes = __parseVTHashes__(out)
if relatedHashes != None:
for entry in relatedHashes:
h.hash_container[entry].append("VT-import-table")
if add_info.has_key("behaviour-v1"):
behavior = add_info["behaviour-v1"]
net = behavior["network"]
udp = net["udp"]
tcp = net["tcp"]
dns = net["dns"]
http = net["http"]
for i in udp:
base = i.split(":")[0]
if base == u"<MACHINE_DNS_SERVER>":
continue
h.ip_container[base].append("VT-behavior")
for i in tcp:
base = i.split(":")[0]
h.ip_container[base].append("VT-behavior")
for i in dns:
h.ip_container[i["ip"]].append("VT-behavior")
h.domain_container[i["hostname"]].append("VT-behavior")
for i in http:
h.url_container[i["url"]].append("VT-behavior")
# full scans are a really expensive VT operation. Make it optional
if fullScan == True:
sections = add_info["sections"]
for i in sections:
sname = i[0]
shash = i[5]
h.section_hash_container[shash].append("VT-section-%s" %sname)
out = pivotEngine.pivotVTFile(shash, "sectionmd5")
relatedHashes = __parseVTHashes__(out)
if relatedHashes == None:
continue
for entry in relatedHashes:
h.hash_container[entry].append("VT-section-%s" %sname)
h.hash_container[dump["md5"]].append("VT-Hash")
return h
out += " ImpHash: %s\n" %self.impHash
for (k,v) in self.sectionHashes.items():
out+= " %s: %s\n" %(k,v)
return out
def everything(self):
return self.pe.dump_info()
if __name__ == "__main__":
sample = sys.argv[1]
ref = REFile(sample)
print "Searching imgHash", ref.impHash, "\nand sectionHash", ref.sectionHashes
jsonResp = pivotEngine.pivotVTFile(ref.impHash, "imphash")
if jsonResp["response_code"] == 1:
print " Related Samples[IMP]:", jsonResp["hashes"]
for i in ref.sectionHashes:
sectionHash = ref.sectionHashes[i]
jsonResp = pivotEngine.pivotVTFile(sectionHash, "sectionmd5")
if jsonResp["response_code"] == 1:
print " Related Samples[SEC]:", jsonResp["hashes"]
