malware_bazaar_api.py - cmikke97/Automatic-Malware-Signature-Generation GitHub Wiki
-
import csv- implements classes to read and write tabular data in CSV format - csv documentation -
import json- json encoder and decoder - json documentation -
import os- provides a portable way of using operating system dependent functionality - os documentation -
import sys- system-specific parameters and functions - sys documentation -
import tempfile- used to create temporary files and directories - tempfile documentation -
import zipfile- provides tools to create, read, write, append, and list a ZIP file - zipfile documentation -
from time import sleep- used to suspend execution of the calling thread for the given number of seconds - time documentation
-
import pyzipper- a replacement for Pythonβs zipfile that can read and write AES encrypted zip files - pyzipper documentation -
import requests- simple HTTP library for Python - requests documentation -
from logzero import logger- robust and effective logging for Python - logzero documentation
MalwareBazaarAPI (class) - Simple Malware Bazaar API class. It implements a few methods to interact with Malware Bazaar Rest API.
-
__init__(self)(member function) - Initialize MalwareBazaarAPI class. -
get_full_data_dump(self, dest_dir, family_list)(member function) - Get Malware Bazaar full data dump.-
dest_dir(arg) - Directory where to extract and save the Malware Bazaar full data dump -
family_list(arg) - List of families to retrieve samples of
-
-
check_sha256(s)(static member function) - Check if the one provided is a valid sha256 hash value.-
s(arg) - (Supposedly) Sha256 of a malware sample
-
-
query(self, query, qtype)(member function) - Get a list of malware samples' info (max 1'000) associated with a specific hash/tag/signature.-
query(arg) - Hash/Tag/signature to retrieve metadata of -
qtype(arg) - Type of query to make; valid options are "hash", "tag" or "signature" (default: 'hash')
-
-
retrieve_malware_sample(self, sha256_hash, dest_dir, unzip)(member function) - Download malware sample from Malware Bazaar given its sha256 hash.-
sha256_hash(arg) - Sha256 hash of the malware sample to retrieve -
dest_dir(arg) - Destination directory where to save file -
unzip(arg) - Whether to unzip downloaded file or not (default: False)
-