New analyser: File Strings

[j-i-m-b-o]

A simple analyser to find printable strings within files.

I've personally found this analyser to be a useful first step when dealing with various types of unknown file so wanted to make it available to others.

[3c7]

Added python3 compatibility

[geekscrapy]

It may also be good to take a look at this at the same time:
https://github.com/fireeye/flare-floss

[jeromeleonard]

I propose to add this feature as a submodule in FileInfo.

[dadokkio]

I've added the feature as submodule. I just need to finish templates.
For flare-floss the support must wait because it doesn't support python3 yet

[geekscrapy]

So, if you use this version it's not floss per-say, but it's more capable than basic strings, and it can rank the strings in order of maliciousness with rankstrings

https://github.com/fireeye/stringsifter

[geekscrapy]

Also, could always use the binary version of floss?

[dadokkio]

Ok, I'll try with the binary tomorrow.
In any case template for strings looks very strange and way too long.

This is a preview:

[3c7]

I've already added FLOSS as a submodule for FileInfo: https://github.com/TheHive-Project/Cortex-Analyzers/tree/feature/fileinfo_floss

[3c7]

(That's why I was assigned ;) )

[dadokkio]

sorry, I didn't knew that and it seems way better than my first attempt with floss :)

[geekscrapy]

I'd say, if you want to at least have the most useful stuff at the top of the long list, use rankstrings.py on the generated output from strings. Might help with the 'long list' situation in the template...

[dadokkio]

@3c7 will you propose a pull request with your changes?

[3c7]

Need more time to fix the template. Currently no time to work on Analyzer stuff.

[dadokkio]

no problem. The plan is to release milestone 2.6.0 this friday, if you need more time I'll move your pr to next release 👍

[dadokkio]

I've added a fix for the template in your repo.
Probably this should resolve the issue (related to duplicated items in the ng-repeat loop)