malice/totalhash repository overview

docker run --rm malice/totalhash SHA1

Usage: totalhash [OPTIONS] COMMAND [arg...]

Malice totalhash Plugin

Version: v0.1.0, BuildTime: 20160219

Author:
  blacktop - <https://github.com/blacktop>

Options:
  --verbose, -V		verbose output
  --elasticsearch value	elasticsearch address for Malice to store results [$MALICE_ELASTICSEARCH]
  --post, -p		POST results to Malice webhook [$MALICE_ENDPOINT]
  --proxy, -x		proxy settings for Malice webhook endpoint [$MALICE_PROXY]
  --table, -t		output as Markdown table
  --user value		totalhash user [$MALICE_TH_USER]
  --key value		totalhash key [$MALICE_TH_KEY]
  --help, -h		show help
  --version, -v		print the version

Commands:
  help	Shows a list of commands or help for one command

Run 'totalhash COMMAND --help' for more information on a command.

{
  "totalhash": {
    "md5": "9483ba381cdb7c983e630839a0d2a1c3",
    "sha1": "4af607a4ecf7885018ab5a788e8f0607b4fcb08b",
    "time": "2015-08-02 00:49:35",
    "version": "0.3",
    "calltree": {
      "process_call": [
        {
          "filename": "C:\\malware.exe",
          "index": "1",
          "pid": "1348",
          "startreason": "AnalysisTarget"
        },
      ...
      ]
    },
    "static": {
      "strings_md5": "ac33aca979aaeee66a70b6a6ad9538bf",
      "strings_sha1": "b24c81ba5dc75edbbd6de5804e7b4a1db38db591",
      "av": [
        {
          "av_product": "bull",
          "scanner": "BullGuard",
          "signature": "Gen:Variant.Graftor.18194",
          "timestamp": "2015-08-01 15:55:42",
          "update": "2015-07-31 07:26:09",
          "version": "14.1.0.0"
        },
        ...
        {
          "av_product": "clam",
          "scanner": "ClamAV",
          "signature": "Trojan.Dropper-22795",
          "timestamp": "2015-08-01 15:55:42",
          "update": "2015-07-31 12:00:00",
          "version": "0.97.8.0"
        }
      ],
      "imphash": {
        "value": "3243b13e562279ab7fbe2f31e45d3a95"
      },
      "imports": [
        {
          "dll": "kernel32.dll"
        }
      ],
      "language": {
        "value": "040904B0"
      },
      "magic": {
        "value": "PE32 executable for MS Windows (GUI) Intel 80386 32-bit"
      },
      "packer": {
        "value": "UPX -> www.upx.sourceforge.net"
      },
      "pehash": {
        "value": "452dda12aae437d193c043388cfc8e1cf9dd0787"
      },
      "section": [
        {
          "md3": "d41d8cd98f00b204e9800998ecf8427e",
          "name": "UPX0",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "size": "0"
        },
        {
          "md3": "be7cee8566021aa22591d9bf68634a88",
          "name": "UPX1",
          "sha1": "f9665ffa7f1b1f10e6265d7e1bf651a3c09793d2",
          "size": "47616"
        },
        {
          "md3": "6e964a0172c2edaff9838cbf467ab13e",
          "name": ".rsrc",
          "sha1": "e793ae7e3e91e59b1195cb8e283194d811013f88",
          "size": "130560"
        },
        {
          "md3": "bf619eac0cdf3f68d496ea9344137e8b",
          "name": ".Kerbero",
          "sha1": "5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5",
          "size": "512"
        },
        {
          "md3": "bf619eac0cdf3f68d496ea9344137e8b",
          "name": ".Kerbero",
          "sha1": "5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5",
          "size": "512"
        },
        {
          "md3": "86759dc484cc49f4800f7f13a4df40d1",
          "name": ".Kerbero",
          "sha1": "27d7d38a1cff80b297b1e4829cf6139af83a038e",
          "size": "66048"
        }
      ],
      "timestamp": {
        "value": "2009-09-12 18:01:17"
      },
      "version": {
        "value": "LegalCopyright:  \nInternalName: rootwarez.org\nFileVersion:  \nCompanyName:  \nLegalTrademarks:  \nComments:  \nProductName:  \nProductVersion: 2.01\nFileDescription:  \nOriginalFilename:   .exe\n"
      }
    }
  }
}