48 lines
1.4 KiB
Markdown
48 lines
1.4 KiB
Markdown
# API Reference: Handling Malware Samples Safely
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` provides three safe, read-only operations: computing a sample's hash
|
|
identity, emitting a provenance record, and defanging IOCs before sharing. It never executes
|
|
a sample.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | Hashing, JSON, regex |
|
|
|
|
## External tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| 7-Zip | Encrypted, password-protected sample archives (`-p`, `-mhe=on`) |
|
|
| certutil / sha256sum | Hashing outside Python where convenient |
|
|
|
|
## Core functions
|
|
|
|
### `compute_hashes(filepath)`
|
|
Returns `md5`, `sha1`, `sha256`, `size` for identification.
|
|
|
|
### `make_record(filepath, source, case)`
|
|
Returns a provenance dict: case, source, filename, UTC timestamp, and hashes.
|
|
|
|
### `defang(text)`
|
|
Rewrites `http(s)://` to `hxxp(s)://` and brackets dots in URLs/IPs so indicators are not
|
|
clickable.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py hash sample.bin
|
|
python scripts/analyst.py record sample.bin --source MalwareBazaar --case CASE-001
|
|
python scripts/analyst.py defang iocs.txt
|
|
```
|
|
|
|
## Sources
|
|
|
|
- MalwareBazaar (abuse.ch) sample-sharing conventions — https://bazaar.abuse.ch/
|
|
- NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response —
|
|
https://csrc.nist.gov/pubs/sp/800/86/final
|
|
- 7-Zip command-line documentation (vendor)
|