1.4 KiB
1.4 KiB
API Reference: Handling Malware Samples Safely
Overview
scripts/analyst.py provides three safe, read-only operations: computing a sample's hash
identity, emitting a provenance record, and defanging IOCs before sharing. It never executes
a sample.
Dependencies
| Package | Version | Purpose |
|---|---|---|
| (stdlib) | — | Hashing, JSON, regex |
External tools
| Tool | Purpose |
|---|---|
| 7-Zip | Encrypted, password-protected sample archives (-p, -mhe=on) |
| certutil / sha256sum | Hashing outside Python where convenient |
Core functions
compute_hashes(filepath)
Returns md5, sha1, sha256, size for identification.
make_record(filepath, source, case)
Returns a provenance dict: case, source, filename, UTC timestamp, and hashes.
defang(text)
Rewrites http(s):// to hxxp(s):// and brackets dots in URLs/IPs so indicators are not
clickable.
Usage
python scripts/analyst.py hash sample.bin
python scripts/analyst.py record sample.bin --source MalwareBazaar --case CASE-001
python scripts/analyst.py defang iocs.txt
Sources
- MalwareBazaar (abuse.ch) sample-sharing conventions — https://bazaar.abuse.ch/
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response — https://csrc.nist.gov/pubs/sp/800/86/final
- 7-Zip command-line documentation (vendor)