Added Shadowserver plugin.

diff --git a/contrib/file_processor/Processor/ShadowServer.pm b/contrib/file_processor/Processor/ShadowServer.pm
new file mode 100644 (file)
index 0000000..c9c7a5f
--- /dev/null
+++ b/contrib/file_processor/Processor/ShadowServer.pm
@@ -0,0 +1,49 @@
+package Processor::ShadowServer;
+use Moose;
+extends 'Processor';
+use Data::Dumper;
+use LWP::UserAgent;
+use JSON;
+
+has 'md5' => (is => 'ro', isa => 'Str', required => 1);
+has 'ua' => (is => 'rw', isa => 'LWP::UserAgent', required => 1, default => sub { return LWP::UserAgent->new(agent => 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.1) Gecko/20100101 Firefox/10.0.1'); });
+has 'url_template' => (is => 'ro', isa => 'Str', required => 1, default => 'http://innocuous.shadowserver.org/api/?query=%s');
+sub name { 'ShadowServer' }
+sub description { 'Processor for shadowserver.com' }
+
+sub process {
+       my $self = shift;
+       my $url = sprintf($self->url_template, $self->md5);
+       $self->log->debug('Getting url ' . $url);
+       my $response = $self->ua->get($url);
+       if ($response->code eq 200){
+               if ($response->decoded_content =~ /No match/){
+                       $self->log->debug('No result');
+                       return 0;
+               }
+               elsif ($response->decoded_content =~ /Whitelisted/){
+                       $self->log->info('Whitelisted');
+                       return 0;
+               }
+               $self->log->info('Got shadowserver.com result');
+               my $ret;
+               eval {
+                       my ($meta,$json) = split(/\n/, $response->decoded_content);
+                       my @meta_cols = qw(md5 sha1 first_date last_date type ssdeep);
+                       my %metas;
+                       @metas{@meta_cols} = split(/\,/, $meta);
+                       $ret = { meta => \%metas, results => decode_json($json) };
+               };
+               if ($@){
+                       $self->log->error($@);
+                       return 0;
+               }
+               return $ret;
+       }
+       else {
+               $self->log->debug('Communications failure: ' . Dumper($response));
+               return 0;
+       }
+}
+
+1

diff --git a/contrib/file_processor/file_processor.conf b/contrib/file_processor/file_processor.conf
index 51af45568f9d348da9a9141f81853d8b698b78c5..a1170ab437cd7ce2a9acd19703eb03679f38dd06 100644 (file)
--- a/contrib/file_processor/file_processor.conf
+++ b/contrib/file_processor/file_processor.conf
@@ -9,6 +9,7 @@
                "Processor::Anubis": 1,
                "Processor::Malwr": 1,
                "Processor::ThreatExpert": 1,
+               "Processor::ShadowServer": 1
                #"Processor::VirusTotal": 1
        }
 }