workbench.workers package

Subpackages

• workbench.workers.rekall_adapter package
  • Submodules
  • workbench.workers.rekall_adapter.rekall_adapter module
  • Module contents

Submodules

workbench.workers.json_meta module

JSON Meta worker

class workbench.workers.json_meta.JSONMetaData

Bases: object

This worker computes meta-data for json files.

Initialization

dependencies = ['sample', 'meta']

execute(input_data)

workbench.workers.json_meta.test()

json_meta.py: Test

workbench.workers.log_meta module

Logfile Meta worker

class workbench.workers.log_meta.LogMetaData

Bases: object

This worker computes a meta-data for log files.

Initialization

dependencies = ['sample', 'meta']

execute(input_data)

workbench.workers.log_meta.test()

log_meta.py: Unit test

workbench.workers.mem_base module

Memory Image base worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_base.MemoryImageBase

Bases: object

This worker computes meta-data for memory image files.

Initialization

dependencies = ['sample']

set_plugin_name(name)

Set the name of the plugin to be used

execute(input_data)

Execute method

workbench.workers.mem_base.test()

mem_base.py: Test

workbench.workers.mem_connscan module

Memory Image ConnScan worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_connscan.MemoryImageConnScan

Bases: workbench.workers.mem_base.MemoryImageBase

This worker computes connscan-data for memory image files.

Initialization

dependencies = ['sample']

execute(input_data)

workbench.workers.mem_dlllist module

Memory Image DllList worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_dlllist.MemoryImageDllList

Bases: workbench.workers.mem_base.MemoryImageBase

This worker computes dlllist for memory image files.

Initialization

dependencies = ['sample']

static safe_key(key)

execute(input_data)

workbench.workers.mem_meta module

Memory Image Meta worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_meta.MemoryImageMeta

Bases: workbench.workers.mem_base.MemoryImageBase

This worker computes meta-data for memory image files.

Initialization

dependencies = ['sample']

execute(input_data)

workbench.workers.mem_procdump module

Memory Image ProcDump worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_procdump.MemoryImageProcDump

Bases: object

This worker dumps process pe files from memory image files.

Initialization

dependencies = ['sample']

execute(input_data)

Execute method

make_temp_directory(*args, **kwds)

__del__()

Class Cleanup

workbench.workers.mem_pslist module

Memory Image PSList worker. This worker utilizes the Rekall Memory Forensic Framework. See Google Github: http://github.com/google/rekall All credit for good stuff goes to them, all credit for bad stuff goes to us. :)

class workbench.workers.mem_pslist.MemoryImagePSList

Bases: workbench.workers.mem_base.MemoryImageBase

This worker computes pslist-data for memory image files.

Initialization

dependencies = ['sample']

execute(input_data)

workbench.workers.meta module

Meta worker

class workbench.workers.meta.MetaData

Bases: object

This worker computes meta data for any file type.

Initialization

dependencies = ['sample']

execute(input_data)

This worker computes meta data for any file type.

workbench.workers.meta.test()

meta.py: Unit test

workbench.workers.meta_deep module

MetaDeep worker

class workbench.workers.meta_deep.MetaDeepData

Bases: object

This worker computes deeper meta-data

Initialization

dependencies = ['sample', 'meta']

execute(input_data)

workbench.workers.meta_deep.test()

meta_deep.py: Unit test

workbench.workers.pcap_bro module

PcapBro worker

class workbench.workers.pcap_bro.PcapBro

Bases: object

This worker runs Bro scripts on a pcap file

dependencies = ['sample']

get_bro_script_path()

setup_pcap_inputs(input_data)

Write the PCAPs to disk for Bro to process and return the pcap filenames

execute(input_data)

Execute

subprocess_manager(exec_args)

Bro subprocess manager

make_temp_directory(*args, **kwds)

Bro temporary directory context manager

__del__()

Class Cleanup

workbench.workers.pcap_bro.test()

pcap_bro.py: Unit test

workbench.workers.pcap_graph module

pcap_graph worker

class workbench.workers.pcap_graph.PcapGraph

Bases: object

This worker generates a graph from a PCAP (depends on Bro)

Initialization

dependencies = ['pcap_bro']

add_node(node_id, name, labels)

Cache aware add_node

add_rel(source_id, target_id, rel)

Cache aware add_rel

execute(input_data)

Okay this worker is going build graphs from PCAP Bro output logs

conn_log_graph(stream)

Build up a graph (nodes and edges from a Bro conn.log)

http_log_graph(stream)

Build up a graph (nodes and edges from a Bro http.log)

dns_log_graph(stream)

Build up a graph (nodes and edges from a Bro dns.log)

weird_log_graph(stream)

Build up a graph (nodes and edges from a Bro weird.log)

files_log_graph(stream)

Build up a graph (nodes and edges from a Bro dns.log)

__del__()

Class Cleanup

workbench.workers.pcap_graph.test()

pcap_graph.py: Unit test

workbench.workers.pcap_http_graph module

pcap_http_graph worker

class workbench.workers.pcap_http_graph.PcapHTTPGraph

Bases: object

This worker generates a graph from a PCAP (depends on Bro)

Initialization

dependencies = ['pcap_bro']

add_node(node_id, name, labels)

Cache aware add_node

add_rel(source_id, target_id, rel)

Cache aware add_rel

execute(input_data)

Okay this worker is going build graphs from PCAP Bro output logs

http_log_graph(stream)

Build up a graph (nodes and edges from a Bro http.log)

weird_log_graph(stream)

Build up a graph (nodes and edges from a Bro weird.log)

files_log_graph(stream)

Build up a graph (nodes and edges from a Bro dns.log)

__del__()

Class Cleanup

workbench.workers.pcap_http_graph.test()

pcap_http_graph.py: Unit test

workbench.workers.pe_classifier module

PE Classify worker (just a placeholder, not a real classifier at this point)

class workbench.workers.pe_classifier.PEFileClassify

Bases: object

This worker classifies PEFiles as Evil or Benign (TOY not a real classifier at this point)

Initialization

dependencies = ['pe_features', 'pe_indicators']

execute(input_data)

This worker classifies PEFiles as Evil or Benign (TOY not a real classifier at this point)

workbench.workers.pe_classifier.test()

pe_classifier.py: Unit test

workbench.workers.pe_deep_sim module

PE SSDeep Similarity worker

class workbench.workers.pe_deep_sim.PEDeepSim

Bases: object

This worker computes fuzzy matches between samples with ssdeep

dependencies = ['meta_deep']

execute(input_data)

Execute method

__del__()

Class Cleanup

workbench.workers.pe_deep_sim.test()

pe_deep_sim.py: Unit test

workbench.workers.pe_features module

PE Features worker. This class pulls static features out of a PE file using the python pefile module.

class workbench.workers.pe_features.PEFileWorker(verbose=False)

Bases: object

Create instance of PEFileWorker class. This class pulls static features out of a PE file using the python pefile module.

Init method

dependencies = ['sample']

execute(input_data)

Process the input bytes with pefile

set_dense_features(dense_feature_list)

Set the dense feature list that the Python pefile module should extract. This is really just sanity check functionality, meaning that these are the features you are expecting to get, and a warning will spit out if you don’t get some of these.

get_dense_features()

Set the dense feature list that the Python pefile module should extract.

set_sparse_features(sparse_feature_list)

Set the sparse feature list that the Python pefile module should extract. This is really just sanity check functionality, meaning that these are the features you are expecting to get, and a warning will spit out if you don’t get some of these.

get_sparse_features()

Set the sparse feature list that the Python pefile module should extract.

static open_using_pefile(input_name, input_bytes)

Open the PE File using the Python pefile module.

extract_features_using_pefile(pef)

Process the PE File using the Python pefile module.

workbench.workers.pe_features.convert_to_utf8(string)

Convert string to UTF8

workbench.workers.pe_features.convert_to_ascii_null_term(string)

Convert string to Null terminated ascii

workbench.workers.pe_features.test()

pe_features.py: Test

workbench.workers.pe_indicators module

This python class codifies a bunch of rules around suspicious static features in a PE File. The rules don’t indicate malicious behavior they simply flag things that may be used by a malicious binary. Many of the indicators used were inspired by the material in the ‘Practical Malware Analysis’ book by Sikorski and Honig, ISBN-13: 978-1593272906 (available on Amazon :)

Description:

PE_WARNINGS = PE module warnings verbatim MALFORMED = the PE file is malformed COMMUNICATION = network activities CREDENTIALS = activities associated with elevating or attaining new privileges KEYLOGGING = activities associated with keylogging SYSTEM_STATE = file system or registry activities SYSTEM_PROBE = getting information from the local system (file system, OS config) SYSTEM_INTEGRITY = compromises the security state of the local system PROCESS_MANIPULATION = indicators associated with process manipulation/injection PROCESS_SPAWN = indicators associated with creating a new process STEALTH_LOAD = indicators associated with loading libraries, resources, etc in a sneaky way ENCRYPTION = any indicators related to encryption COM_SERVICES = COM functionality or running as a service ANTI_DEBUG = anti-debugging indicators

class workbench.workers.pe_indicators.PEIndicators

Bases: object

Create instance of Indicators class. This class uses the static features from the pefile module to look for weird stuff.

Note: All methods that start with ‘check’ will be automatically included as part of the checks that happen when ‘execute’ is called.

Init method of the Indicators class.

dependencies = ['sample']

execute(input_data)

Execute the PEIndicators worker

check_corrupted_imports()

Various ways the imports table might be corrupted.

check_checksum_is_zero()

Checking for a checksum of zero

check_checksum_mismatch()

Checking for a checksum that doesn’t match the generated checksum

check_empty_section_name()

Checking for an empty section name

check_nonstandard_section_name()

Checking for an non-standard section name

check_image_size_incorrect()

Checking if the reported image size matches the actual image size

check_overlapping_headers()

Checking if pefile module reported overlapping header

check_section_unaligned()

Checking if any of the sections are unaligned

check_section_oversized()

Checking if any of the sections go past the total size of the image

check_dll_with_no_exports()

Checking if the PE is a DLL with no exports

check_communication_imports()

Checking if the PE imports known communication methods

check_elevating_privs_imports()

Checking if the PE imports known methods associated with elevating or attaining new privileges

check_keylogging_imports()

Checking if the PE imports known methods associated with elevating or attaining new privileges

check_system_state_imports()

Checking if the PE imports known methods associated with changing system state

check_system_probe_imports()

Checking if the PE imports known methods associated with probing the system

check_system_integrity_imports()

Checking if the PE imports known methods associated with system security or integrity

check_crypto_imports()

Checking if the PE imports known methods associated with encryption

check_anti_debug_imports()

Checking if the PE imports known methods associated with anti-debug

check_com_service_imports()

Checking if the PE imports known methods associated with COM or services

check_process_manipulation()

Checking if the PE imports known methods associated with process manipulation/injection

check_process_spawn()

Checking if the PE imports known methods associated with spawning a new process

check_stealth_load()

Checking if the PE imports known methods associated with loading libraries, resources, etc in a sneaky way

check_invalid_entry_point()

Checking the PE File warning for an invalide entry point

check_exports()

This is just a stub function right now, might be useful later

workbench.workers.pe_indicators.convert_to_ascii_null_term(string)

Convert string to null terminated ascii string

workbench.workers.pe_indicators.test()

pe_indicators.py: Unit test

workbench.workers.pe_peid module

PE peid worker, uses the peid_userdb.txt database of signatures

class workbench.workers.pe_peid.PEIDWorker

Bases: object

This worker looks up pe_id signatures for a PE file.

dependencies = ['sample']

execute(input_data)

Execute the PEIDWorker

peid_features(pefile_handle)

Get features from PEid signature database

workbench.workers.pe_peid.test()

pe_peid.py: Unit test

workbench.workers.strings module

Strings worker

class workbench.workers.strings.Strings

Bases: object

This worker extracts all the strings from any type of file

Initialize the Strings worker

dependencies = ['sample']

execute(input_data)

Execute the Strings worker

workbench.workers.strings.test()

strings.py: Unit test

workbench.workers.swf_meta module

SWFMeta worker: This is a stub the real class (under the experimental directory has too many dependencies)

class workbench.workers.swf_meta.SWFMeta

Bases: object

This worker computes a bunch of meta-data about a SWF file

dependencies = ['sample', 'meta']

execute(input_data)

Execute the SWFMeta worker

workbench.workers.swf_meta.test()

swf_meta.py: Unit test

workbench.workers.unzip module

Unzip worker

class workbench.workers.unzip.Unzip

Bases: object

This worker unzips a zipped file

dependencies = ['sample']

execute(input_data)

Execute the Unzip worker

__del__()

Class Cleanup

workbench.workers.unzip.test()

unzip.py: Unit test

workbench.workers.url module

URLS worker: Tries to extract URL from strings output

class workbench.workers.url.URLS

Bases: object

This worker looks for url patterns in strings output

Initialize the URL worker

dependencies = ['strings']

execute(input_data)

Execute the URL worker

workbench.workers.url.test()

url.py: Unit test

workbench.workers.view module

view worker

class workbench.workers.view.View

Bases: object

View: Generates a view for any file type

dependencies = ['meta']

execute(input_data)

__del__()

Class Cleanup

workbench.workers.view.test()

view.py: Unit test

workbench.workers.view_customer module

view_customer worker

class workbench.workers.view_customer.ViewCustomer

Bases: object

ViewCustomer: Generates a customer usage view.

dependencies = ['meta']

execute(input_data)

Execute Method

workbench.workers.view_customer.test()

view_customer.py: Unit test

workbench.workers.view_log_meta module

view_log_meta worker

class workbench.workers.view_log_meta.ViewLogMeta

Bases: object

ViewLogMeta: Generates a view for meta data on the sample

dependencies = ['log_meta']

execute(input_data)

Execute the ViewLogMeta worker

workbench.workers.view_log_meta.test()

view_log_meta.py: Unit test

workbench.workers.view_memory module

view_memory worker

class workbench.workers.view_memory.ViewMemory

Bases: object

ViewMemory: Generates a view for meta data on the sample

dependencies = ['mem_connscan', 'mem_meta', 'mem_procdump', 'mem_pslist']

execute(input_data)

Execute the ViewMemory worker

workbench.workers.view_memory.test()

view_memory.py: Unit test

workbench.workers.view_meta module

view_meta worker

class workbench.workers.view_meta.ViewMetaData

Bases: object

ViewMetaData: Generates a view for meta data on the sample

dependencies = ['meta']

execute(input_data)

Execute the ViewMetaData worker

workbench.workers.view_meta.test()

view_meta.py: Unit test

workbench.workers.view_pcap module

view_pcap worker

class workbench.workers.view_pcap.ViewPcap

Bases: object

ViewPcap: Generates a view for a pcap sample (depends on Bro)

dependencies = ['pcap_bro']

execute(input_data)

Execute

__del__()

Class Cleanup

workbench.workers.view_pcap.test()

view_pcap.py: Unit test

workbench.workers.view_pcap_details module

view_pcap_details worker

class workbench.workers.view_pcap_details.ViewPcapDetails

Bases: object

ViewPcapDetails: Generates a view for a pcap sample (depends on Bro)

Initialization of ViewPcapDetails

dependencies = ['view_pcap']

execute(input_data)

ViewPcapDetails execute method

__del__()

Class Cleanup

workbench.workers.view_pcap_details.test()

view_pcap_details.py: Unit test

workbench.workers.view_pdf module

view_pdffile worker

class workbench.workers.view_pdf.ViewPDFFile

Bases: object

ViewPDFFile: Generates a view for PDF files

dependencies = ['meta', 'strings']

execute(input_data)

Execute the ViewPDF worker

workbench.workers.view_pdf.test()

‘ view_pdf.py: Unit test

workbench.workers.view_pe module

view_pe worker

class workbench.workers.view_pe.ViewPEFile

Bases: object

Generates a high level summary view for PE files that incorporates a large set of workers

dependencies = ['meta', 'strings', 'pe_peid', 'pe_indicators', 'pe_classifier']

execute(input_data)

Execute the ViewPEFile worker

static safe_get(data, key_list)

Safely access dictionary keys when plugin may have failed

workbench.workers.view_pe.test()

view_pe.py: Unit test

workbench.workers.view_zip module

view_zip worker

class workbench.workers.view_zip.ViewZip

Bases: object

ViewZip: Generates a view for Zip files

dependencies = ['meta', 'unzip']

execute(input_data)

Execute the ViewZip worker

__del__()

Class Cleanup

workbench.workers.view_zip.test()

– view_zip.py test –

workbench.workers.vt_query module

VTQuery worker

class workbench.workers.vt_query.VTQuery

Bases: object

This worker query Virus Total, an apikey needs to be provided

VTQuery Init

dependencies = ['meta']

execute(input_data)

Execute the VTQuery worker

workbench.workers.vt_query.test()

– vt_query.py test –

workbench.workers.yara_sigs module

Yara worker

class workbench.workers.yara_sigs.YaraSigs

Bases: object

This worker check for matches against yara sigs. Output keys: [matches:list of matches]

dependencies = ['sample']

get_yara_rules()

Recursively traverse the yara/rules directory for rules

execute(input_data)

yara worker execute method

workbench.workers.yara_sigs.test()

yara.py: Unit test

Module contents