types

Documentation

Index

• Constants
• Variables
• type Actor
• type Actors
• type Endpoint
• type Families
• type Family
• type FamilySample
• type FamilySamples
• type FindActor
• type FindActorElement
• type FindFamily
• type FindFamilyElement
• type ListFamilySamples
• type Meta
• type Properties
• type Related
• type SampleState
• type Version
• type YaraMatchesValue
• type ZippedResults

Constants

const (
	EndpointGetSampleRaw          = "/get/sample/%s/raw"
	EndpointGetSampleZip          = "/get/sample/%s/zip"
	EndpointVersion               = "/get/version"
	EndpointGetActors             = "/list/actors"
	EndpointGetActor              = "/get/actor/%s"
	EndpointGetYaraRaw            = "/get/yara/%s/raw"
	EndpointGetYaraZip            = "/get/yara/%s/zip"
	EndpointFindActor             = "/find/actor/%s"
	EndpointGetFamilies           = "/get/families"
	EndpointGetFamily             = "/get/family/%s"
	EndpointFindFamily            = "/find/family/%s"
	EndpointGetYaraRulesForFamily = "/get/yara/%s/zip"
	EndpointListFamilySamples     = "/list/samples/%s"
	EndpointScanBinary            = "/scan/binary"
	EndpointScanYara              = "/scan/yara"
	EndpointScanYaraAgainstFamily = "/scan/yara/%s"
)

const (
	APIBase         = "https://malpedia.caad.fkie.fraunhofer.de/api"
	Dumped   string = "dumped"
	Packed   string = "packed"
	Unpacked string = "unpacked"
)

Variables

var ErrResourceNotFound = errors.New("Resource Not Found")

Types

type Actor

type Actor struct {
	Value       string            `json:"value"`
	Meta        Meta              `json:"meta"`
	Families    map[string]Family `json:"families"`
	Description string            `json:"description"`
	Related     []Related         `json:"related"`
	UUID        string            `json:"uuid"`
}

type Actors

type Actors []string

type Endpoint

type Endpoint string

type Families

type Families map[string]Family

GetFamilies ----------------------------------------------------------

type Family

type Family struct {
	Updated     string        `json:"updated"`
	Attribution []string      `json:"attribution"`
	Description string        `json:"description"`
	Notes       []string      `json:"notes"`
	AltNames    []string      `json:"alt_names"`
	Sources     []interface{} `json:"sources"`
	Urls        []string      `json:"urls"`
	CommonName  string        `json:"common_name"`
	UUID        *string       `json:"uuid,omitempty"`
	Properties  *Properties   `json:"properties,omitempty"`
}

type FamilySample

type FamilySample struct {
	Status  string `json:"status"`
	Sha256  string `json:"sha256"`
	Version string `json:"version"`
}

type FamilySamples

type FamilySamples map[string][]FamilySample

type FindActor

type FindActor []FindActorElement

type FindActorElement

type FindActorElement struct {
	CommonName string   `json:"common_name"`
	Synonyms   []string `json:"synonyms"`
	Name       string   `json:"name"`
}

FindActor -----------------------------------------------------------

type FindFamily

type FindFamily []FindFamilyElement

FindFamily ----------------------------------------------------------

type FindFamilyElement

type FindFamilyElement struct {
	Name     string   `json:"name"`
	AltNames []string `json:"alt_names"`
}

type ListFamilySamples

type ListFamilySamples struct {
	Status  string `json:"status"`
	Sha256  string `json:"sha256"`
	Version string `json:"version"`
}

ListFamilySamples ----------------------------------------------------------

type Meta

type Meta struct {
	CfrSuspectedVictims      []string `json:"cfr-suspected-victims"`
	Country                  string   `json:"country"`
	Refs                     []string `json:"refs"`
	CfrTargetCategory        []string `json:"cfr-target-category"`
	CfrTypeOfIncident        string   `json:"cfr-type-of-incident"`
	Synonyms                 []string `json:"synonyms"`
	CfrSuspectedStateSponsor string   `json:"cfr-suspected-state-sponsor"`
	AttributionConfidence    string   `json:"attribution-confidence"`
}

type Properties

type Properties struct {
	ProgrammingLanguage string        `json:"programming_language"`
	Iat                 string        `json:"iat"`
	Obfuscation         []interface{} `json:"obfuscation"`
	PEHeader            string        `json:"pe_header"`
	ValidTimestamp      string        `json:"valid_timestamp"`
}

type Related

type Related struct {
	DestUUID string   `json:"dest-uuid"`
	Type     string   `json:"type"`
	Tags     []string `json:"tags"`
}

type SampleState

type SampleState *map[string]bytes.Buffer

SampleState represents a acquired file from malpedia. Malpedia will return a sample at multiple states so you can see it dumped at different addresses and being packed or unpacked

type Version

type Version struct {
	Date    string `json:"date"`
	Version int    `json:"version"`
}

GetVersion -----------------------------------------------------------

type YaraMatchesValue

type YaraMatchesValue struct {
	MatchedStrings int64 `json:"matched_strings"`
	MatchedHits    int64 `json:"matched_hits"`
	Match          bool  `json:"match"`
}

ScanBinary ----------------------------------------------------------

type ZippedResults

type ZippedResults struct {
	Zipped string `json:"zipped"`
}