diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..098d298 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ + +~/Desktop/malwarehouse/malwarehouse.db diff --git a/malwarehouse.py b/malwarehouse.py index 85554f7..ba7f9e3 100644 --- a/malwarehouse.py +++ b/malwarehouse.py @@ -57,19 +57,7 @@ def get_sha256(malware_path): def summary(report_json): """Prints an easy to read summary of the malware.""" - summary = "" - summary += "datetime: %s\n" % (report_json['datetime']) - summary += "name: %s\n" % (report_json['name']) - summary += "tags: %s\n" % (report_json['tags']) - summary += "size: %s\n" % (report_json['size']) - summary += "md5: %s\n" % (report_json['md5']) - summary += "sha256: %s\n" % (report_json['sha256']) - summary += "source: %s\n" % (report_json['source']) - summary += "notes: %s\n" % (report_json["notes"]) - summary += "\n" - summary += "sample directory: %s" % option_base_dir + report_json['sha256'] - - return summary + return "- %s (%s) - %s" % (report_json['name'], report_json['source'], report_json['md5']) def details(report_json): """Prints an easy to read summary of the malware.""" @@ -86,7 +74,7 @@ def details(report_json): details += "\n" details += "sample directory: %s" % option_base_dir + report_json['sha256'] - return summary + return details def load_db(report_json): """Load information about the sample into the index DB.""" @@ -119,7 +107,7 @@ def load_directory(report_json, malware_path): shutil.move(malware_path, sample_dir) with open(sample_dir + '/summary.txt', 'w') as text_file: - text_file.write(print_summary(report_json)) + text_file.write(details(report_json)) return True @@ -129,22 +117,24 @@ def find_sample(find_string): c = conn.cursor() if re.findall(r"^([a-fA-F\d]{32})$", find_string): - print "\nResults for md5: %s" % find_string + #print "\nResults for md5: %s" % find_string c.execute("SELECT * FROM malwarehouse_index WHERE md5 = ?", (find_string,)) elif re.findall(r"^([a-fA-F\d]{64})$", find_string): - print "\nResults for sha256: %s" % find_string + #print "\nResults for sha256: %s" % find_string c.execute("SELECT * FROM malwarehouse_index WHERE sha256 = ?", (find_string,)) else: - print "\nResults for file name: %s" % find_string + #print "\nResults for file name: %s" % find_string c.execute("SELECT * FROM malwarehouse_index WHERE name = ?", (find_string,)) - data=c.fetchone() + data=c.fetchall() if data is None: print('There is no component named %s'%find_string) return False else: - print print_summary({'datetime': data[0], 'name': data[1], 'tags':data[2], 'size': data[3], 'md5': data[4], 'sha256': data[5], 'source': data[6], 'notes': data[7]}) + print "\nResults:" + for result in data: + print summary({'datetime': result[0], 'name': result[1], 'tags':result[2], 'size': result[3], 'md5': result[4], 'sha256': result[5], 'source': result[6], 'notes': result[7]}) return True diff --git a/~/Desktop/malwarehouse/malwarehouse.db b/~/Desktop/malwarehouse/malwarehouse.db deleted file mode 100644 index 71ffbf2..0000000 Binary files a/~/Desktop/malwarehouse/malwarehouse.db and /dev/null differ