New hashdd api

analyzers/Hashdd/Hashdd.py

@@ -5,90 +5,75 @@
 
 
 class HashddAnalyzer(Analyzer):
-    service = 'Status'
-    url = 'https://api.hashdd.com/'
+    service = "Status"
+    url = "https://api.hashdd.com/"
     hashdd_key = None
 
     def __init__(self):
         Analyzer.__init__(self)
-        self.service = self.get_param('config.service', None, 'Service parameter is missing')
+        self.service = self.get_param(
+            "config.service", None, "Service parameter is missing"
+        )
 
         if self.service == "status":
-            self.url = 'https://api.hashdd.com/'
+            self.hashdd_key = self.get_param("config.api_key", None)
+            self.url = "https://api.hashdd.com/v1/knownlevel/"
         elif self.service == "detail":
-            self.hashdd_key = self.get_param('config.api_key', None, 'Missing hashdd API key')
-            self.url = 'https://api.hashdd.com/detail'
+            self.hashdd_key = self.get_param(
+                "config.api_key", None, "Missing hashdd API key"
+            )
+            self.url = "https://api.hashdd.com/v1/detail/"
 
     def hashdd_check(self, data):
         if self.hashdd_key is None:
-            postdata = {'hash': self.get_data()}
+            headers = {}
         else:
-            postdata = {'hash': self.get_data(), 'api_key': self.hashdd_key}
-
-        r = requests.post(self.url, data=postdata)
+            headers = {"X-API-KEY": self.hashdd_key}
+        r = requests.get("{}{}".format(self.url, data), headers=headers, verify=False)
         r.raise_for_status()  # Raise exception on HTTP errors
         return r.json()
 
     def summary(self, raw):
         taxonomies = []
-        namespace = 'Hashdd'
-        predicate = 'known_level'
-        value = "0"
-
-        level = 'info'  # Default level: this assigned when known_level is unknown
-
-        if 'known_level' in raw:
-            known_level = raw['known_level']
-            if known_level == 'Good':
+        namespace = "Hashdd"
+        predicate = "knownlevel"
+        value = "Unknown"
+        knownlevel = "Unknown"
+        level = "info"
+        if self.service == "status" and "knownlevel" in raw:
+            knownlevel = raw["knownlevel"]
+            if knownlevel == "Good":
                 level = "safe"
-            elif known_level == 'Bad':
+            elif knownlevel == "Bad":
                 level = "malicious"
-            # else:
-            #     level = "suspicious" # this one is not used
-
-            value = "{}".format(known_level)  # Value must be enclosed with double quotes
+            value = "{}".format(knownlevel)
 
+        elif self.service == "detail":
+            if "Bad" in [x["knownlevel"] for x in raw["search_results"]]:
+                level = "malicious"
+                knownlevel = "Bad"
+            elif "Good" in [x["knownlevel"] for x in raw["search_results"]]:
+                level = "safe"
+                knownlevel = "Good"
+            value = "{}".format(knownlevel)
         taxonomies.append(self.build_taxonomy(level, namespace, predicate, value))
-
         return {"taxonomies": taxonomies}
 
     def run(self):
-        if self.data_type != 'hash':
+        if self.data_type != "hash":
             self.notSupported()
 
-        data = self.get_param('data', None, 'Data is missing')
-        hash = data.upper()
-
+        data = self.get_param("data", None, "Data is missing")
         response = self.hashdd_check(data)
 
-        if response['result'] == 'SUCCESS':
-
+        if response["result"] == "SUCCESS":
             if self.service == "status":
-                self.report({
-                    'known_level': response[hash]['known_level']
-                })
+                self.report({"knownlevel": response["knownlevel"]})
             elif self.service == "detail":
-                if response.get(hash).get('result') != "NOT_FOUND":
-                    self.report({
-                        'known_level': response[hash]['summary']['hashdd_known_level'],
-                        'file_name': response[hash]['summary']['hashdd_file_name'],
-                        'file_absolute_path': response[hash]['summary']['hashdd_file_absolute_path'],
-                        'size': response[hash]['summary']['hashdd_size'],
-                        'product_manufacturer': response[hash]['summary']['hashdd_product_manufacturer'],
-                        'product_name': response[hash]['summary']['hashdd_product_name'],
-                        'product_version': response[hash]['summary']['hashdd_product_version'],
-                        'architecture': response[hash]['summary']['hashdd_architecture'],
-                        'md5': response[hash]['summary']['hashdd_md5'],
-                        'sha1': response[hash]['summary']['hashdd_sha1'],
-                        'sha256': response[hash]['summary']['hashdd_sha256'],
-                        'ssdeep': response[hash]['summary']['hashdd_ssdeep']
-                    })
-                else:
-                    self.report({'known_level':'Unknown'})
-
+                self.report(response)
         else:
-            self.error('{}'.format(response['result']))
+            self.error("{}".format(response["result"]))
 
 
-if __name__ == '__main__':
+if __name__ == "__main__":
     HashddAnalyzer().run()

analyzers/Hashdd/Hashdd_Detail.json

@@ -1,23 +1,23 @@
 {
-    "name": "Hashdd_Detail",
-    "version": "1.0",
-    "author": "iosonogio",
-    "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
-    "license": "AGPLv3",
-    "description": "Determine whether a hash is good or bad; if good then list what it is.",
-    "dataTypeList": ["hash"],
-    "baseConfig": "Hashdd",
-    "config": {
-      "service": "detail"
-    },
-    "command": "Hashdd/Hashdd.py",
-    "configurationItems": [
-      {
-        "name": "api_key",
-        "description": "API key for hashdd",
-        "type": "string",
-        "multi": false,
-        "required": true
-      }
-    ]
+  "name": "Hashdd_Detail",
+  "version": "2.0",
+  "author": "iosonogio, dadokkio",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "license": "AGPLv3",
+  "description": "Determine whether a hash is good or bad; if good then list what it is.",
+  "dataTypeList": ["hash"],
+  "baseConfig": "Hashdd",
+  "config": {
+    "service": "detail"
+  },
+  "command": "Hashdd/Hashdd.py",
+  "configurationItems": [
+    {
+      "name": "api_key",
+      "description": "API key for hashdd",
+      "type": "string",
+      "multi": false,
+      "required": true
+    }
+  ]
 }

analyzers/Hashdd/Hashdd_Status.json

@@ -1,23 +1,23 @@
 {
-    "name": "Hashdd_Status",
-    "version": "1.0",
-    "author": "iosonogio",
-    "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
-    "license": "AGPLv3",
-    "description": "Determine whether a hash is good or bad.",
-    "dataTypeList": ["hash"],
-    "baseConfig": "Hashdd",
-    "config": {
-      "service": "status"
-    },
-    "command": "Hashdd/Hashdd.py",
-    "configurationItems": [
-      {
-        "name": "api_key",
-        "description": "API key for hashdd",
-        "type": "string",
-        "multi": false,
-        "required": false
-      }
-    ]
+  "name": "Hashdd_Status",
+  "version": "2.0",
+  "author": "iosonogio, dadokkio",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "license": "AGPLv3",
+  "description": "Determine whether a hash is good or bad.",
+  "dataTypeList": ["hash"],
+  "baseConfig": "Hashdd",
+  "config": {
+    "service": "status"
+  },
+  "command": "Hashdd/Hashdd.py",
+  "configurationItems": [
+    {
+      "name": "api_key",
+      "description": "API key for hashdd",
+      "type": "string",
+      "multi": false,
+      "required": false
+    }
+  ]
 }

thehive-templates/Hashdd_Detail_2_0/long.html

@@ -0,0 +1,53 @@
+<!-- Success -->
+<div class="panel panel-info" ng-if="success">
+
+    <style>
+        dl.dl-horizontal {
+            margin-bottom: 1px;
+        }
+
+        .dl-horizontal dt {
+            width: 300px;
+        }
+
+        .dl-horizontal dd {
+            margin-left: 310px;
+        }
+    </style>
+
+
+
+    <div class="panel-heading">
+        Hashdd report for <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+
+        <div ng-repeat="result in content.search_results">
+            <dl class="dl-horizontal" ng-if="$index == 0">
+                <dt>Knowlevel:</dt>
+                <dd class="wrap">{{result.knownlevel}}</dd>
+                <dt>MD5:</dt>
+                <dd class="wrap">{{result.details.hashdd_md5}}</dd>
+                <dt>SHA1:</dt>
+                <dd class="wrap">{{result.details.hashdd_sha1}}</dd>
+                <dt>CRC32:</dt>
+                <dd class="wrap">{{result.details.hashdd_crc32}}</dd>
+                <dt>Size:</dt>
+                <dd class="wrap">{{result.details.hashdd_size}}</dd>
+                <dt>Results:</dt>
+                <dd class="wrap">{{content.search_results.length}}</dd>
+            </dl>
+        </div>
+
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        {{content.errorMessage}}
+    </div>
+</div>

thehive-templates/Hashdd_Status_1_0/long.html → thehive-templates/Hashdd_Status_2_0/long.html

@@ -4,10 +4,10 @@
         Hashdd report for <strong>{{artifact.data | fang}}</strong>
     </div>
     <div class="panel-body">
-            <dl class="dl-horizontal" ng-if="content.known_level">
-                <dt>Known Level</dt>
-                <dd>{{content.known_level || "No known level given."}}</dd>
-            </dl>
+        <dl class="dl-horizontal" ng-if="content.knownlevel">
+            <dt>Known Level</dt>
+            <dd>{{content.knownlevel || "No known level given."}}</dd>
+        </dl>
     </div>
 </div>
 
@@ -19,4 +19,4 @@
     <div class="panel-body">
         {{content.errorMessage}}
     </div>
-</div>
+</div>