(self, sha)
Return the analysis of a hash
Return the analysis of a hash
Return the analysis of a hash
def analysis(self, sha):
        """
        Return the analysis of a hash
        """
        sign = hmac.new(
            self.key.encode("utf-8"),
            sha.encode("utf-8"),
            hashlib.sha256
        ).hexdigest()
        res = self._query("/analysis/%s&id=%s&sign=%s" % (sha, self.user, sign))
        if res.status_code != 200:
            if res.status_code == 404:
                raise TotalHashNotFound()
            else:
                raise TotalHashError()
        else:
            try:
                root = ET.fromstring(res.text)
            except ET.ParseError:
                raise TotalHashError()

            # May not be complete
            results = {
                'sha1': root.attrib['sha1'],
                'time': parse(root.attrib['time']),
                'url': 'https://totalhash.cymru.com/analysis/?%s' % root.attrib['sha1'],
                'sections': [],
                'detections': [],
                'running_processes': [],
                'calltree': [],
                'network': {'dns': [], 'flows': []},
                'imports': [],
                'processes': []
            }
            try:
                results["md5"] = root.attrib['md5']
            except KeyError:
                pass
            try:
                results['magic'] = root.findall('static/magic')[0].attrib['value']
            except IndexError:
                pass
            try:
                results['timestamp'] = parse(root.findall('static/timestamp')[0].attrib['value'])
            except IndexError:
                pass
            try:
                results['pehash'] = root.findall('static/pehash')[0].attrib['value']
            except IndexError:
                pass
            for s in root.findall('static/section'):
                results['sections'].append(s.attrib)
            for i in root.findall('static/imports'):
                results['imports'].append(i.attrib['dll'])
            for a in root.findall('static/av'):
                results['detections'].append(a.attrib)
            for a in root.findall('network-pcap/dns'):
                results['network']['dns'].append(a.attrib)
            for a in root.findall('network-pcap/flows'):
                results['network']['flows'].append(a.attrib)
            for a in root.findall('running_processes/running_process'):
                results['running_processes'].append(a.attrib)
            for a in root.findall('calltree/process_call'):
                results['calltree'].append(a.attrib)

            # Processes
            for p in root.findall('processes/process'):
                pinfo = {
                        'dll': [],
                        'file': [],
                        'process': [],
                        'registry': [],
                        'mutex': []
                }
                for a in p.attrib:
                    pinfo[a] = p.attrib[a]

                for dll in p.findall('dll_handling_section/load_dll'):
                    pinfo['dll'].append(dll.attrib)
                for f in p.findall('filesystem_section/create_file'):
                    pinfo['file'].append(f.attrib)
                for pp in p.findall('process_section/create_process'):
                    pinfo['process'].append(pp.attrib)

                for r in p.findall('registry_section/set_value'):
                    pinfo['registry'].append(r.attrib)
                for m in p.findall('mutex_section/create_mutex'):
                    pinfo['mutex'].append(m.attrib)
                results['processes'].append(pinfo)

            return results
def analysis ( self , sha ) : sign = hmac . new ( self . key . encode ( "utf-8" ) , sha . encode ( "utf-8" ) , hashlib . sha256 ) . hexdigest ( ) res = self . _query ( "/analysis/%s&id=%s&sign=%s" % ( sha , self . user , sign ) ) if res . status_code != 200 : if res . status_code == 404 : raise TotalHashNotFound ( ) else : raise TotalHashError ( ) else : try : root = ET . fromstring ( res . text ) except ET . ParseError : raise TotalHashError ( ) # May not be complete results = { 'sha1' : root . attrib [ 'sha1' ] , 'time' : parse ( root . attrib [ 'time' ] ) , 'url' : 'https://totalhash.cymru.com/analysis/?%s' % root . attrib [ 'sha1' ] , 'sections' : [ ] , 'detections' : [ ] , 'running_processes' : [ ] , 'calltree' : [ ] , 'network' : { 'dns' : [ ] , 'flows' : [ ] } , 'imports' : [ ] , 'processes' : [ ] } try : results [ "md5" ] = root . attrib [ 'md5' ] except KeyError : pass try : results [ 'magic' ] = root . findall ( 'static/magic' ) [ 0 ] . attrib [ 'value' ] except IndexError : pass try : results [ 'timestamp' ] = parse ( root . findall ( 'static/timestamp' ) [ 0 ] . attrib [ 'value' ] ) except IndexError : pass try : results [ 'pehash' ] = root . findall ( 'static/pehash' ) [ 0 ] . attrib [ 'value' ] except IndexError : pass for s in root . findall ( 'static/section' ) : results [ 'sections' ] . append ( s . attrib ) for i in root . findall ( 'static/imports' ) : results [ 'imports' ] . append ( i . attrib [ 'dll' ] ) for a in root . findall ( 'static/av' ) : results [ 'detections' ] . append ( a . attrib ) for a in root . findall ( 'network-pcap/dns' ) : results [ 'network' ] [ 'dns' ] . append ( a . attrib ) for a in root . findall ( 'network-pcap/flows' ) : results [ 'network' ] [ 'flows' ] . append ( a . attrib ) for a in root . findall ( 'running_processes/running_process' ) : results [ 'running_processes' ] . append ( a . attrib ) for a in root . findall ( 'calltree/process_call' ) : results [ 'calltree' ] . append ( a . attrib ) # Processes for p in root . findall ( 'processes/process' ) : pinfo = { 'dll' : [ ] , 'file' : [ ] , 'process' : [ ] , 'registry' : [ ] , 'mutex' : [ ] } for a in p . attrib : pinfo [ a ] = p . attrib [ a ] for dll in p . findall ( 'dll_handling_section/load_dll' ) : pinfo [ 'dll' ] . append ( dll . attrib ) for f in p . findall ( 'filesystem_section/create_file' ) : pinfo [ 'file' ] . append ( f . attrib ) for pp in p . findall ( 'process_section/create_process' ) : pinfo [ 'process' ] . append ( pp . attrib ) for r in p . findall ( 'registry_section/set_value' ) : pinfo [ 'registry' ] . append ( r . attrib ) for m in p . findall ( 'mutex_section/create_mutex' ) : pinfo [ 'mutex' ] . append ( m . attrib ) results [ 'processes' ] . append ( pinfo ) return results