├── data
├── yara
│ ├── memory
│ │ ├── .gitignore
│ │ └── index_memory.yar
│ ├── urls
│ │ └── .gitignore
│ └── binaries
│ │ ├── shellcodes.yar
│ │ └── embedded.yar
├── src
│ └── binpackage
│ │ ├── Makefile
│ │ └── execsc.c
├── peutils
│ └── UserDB.TXT
├── html
│ ├── img
│ │ ├── glyphicons-halflings.png
│ │ └── glyphicons-halflings-white.png
│ ├── sections
│ │ ├── errors.html
│ │ ├── screenshots.html
│ │ ├── javascript_hooks.html
│ │ ├── signatures.html
│ │ ├── shellcode_detect.html
│ │ ├── info.html
│ │ └── url.html
│ ├── error.html
│ ├── success.html
│ ├── js
│ │ └── functions.js
│ ├── report.html
│ └── pagination-rpp.html
├── signature_overlay.json
└── test-internet.vbs
├── web
├── dashboard
│ ├── __init__.py
│ ├── urls.py
│ └── views.py
├── static
│ ├── img
│ │ ├── next.png
│ │ ├── prev.png
│ │ ├── close.png
│ │ └── loading.gif
│ ├── graphic
│ │ ├── cuckoo.png
│ │ └── background.png
│ └── fonts
│ │ ├── glyphicons-halflings-regular.eot
│ │ ├── glyphicons-halflings-regular.ttf
│ │ ├── glyphicons-halflings-regular.woff
│ │ └── glyphicons-halflings-regular.woff2
├── templates
│ ├── standalone_error.html
│ ├── analysis
│ │ ├── behavior
│ │ │ ├── index.html
│ │ │ ├── _tree.html
│ │ │ ├── _tree_process.html
│ │ │ ├── _chunk.html
│ │ │ ├── _search.html
│ │ │ ├── _api_call.html
│ │ │ └── _search_results.html
│ │ ├── static
│ │ │ ├── _strings.html
│ │ │ ├── index.html
│ │ │ └── _antivirus.html
│ │ ├── overview
│ │ │ ├── _url.html
│ │ │ ├── _screenshots.html
│ │ │ ├── index.html
│ │ │ ├── _summary.html
│ │ │ └── _file.html
│ │ ├── memory
│ │ │ ├── _yarascan.html
│ │ │ ├── _callbacks.html
│ │ │ ├── _malfind.html
│ │ │ ├── _apihooks.html
│ │ │ ├── _idt.html
│ │ │ ├── _modscan.html
│ │ │ ├── _timers.html
│ │ │ ├── _devicetree.html
│ │ │ ├── _ssdt.html
│ │ │ ├── _gdt.html
│ │ │ ├── _messagehooks.html
│ │ │ ├── _pslist.html
│ │ │ └── _svcscan.html
│ │ ├── network
│ │ │ ├── _http.html
│ │ │ ├── _hosts.html
│ │ │ ├── _irc.html
│ │ │ ├── _icmp.html
│ │ │ ├── _dns.html
│ │ │ ├── _udp.html
│ │ │ └── index.html
│ │ ├── procmemory
│ │ │ └── index.html
│ │ ├── admin
│ │ │ └── index.html
│ │ ├── pending.html
│ │ └── report.html
│ ├── error.html
│ ├── success.html
│ ├── base.html
│ ├── submission
│ │ ├── complete.html
│ │ └── status.html
│ ├── footer.html
│ ├── compare
│ │ ├── _info.html
│ │ ├── _summary_table.html
│ │ ├── hash.html
│ │ └── left.html
│ ├── dashboard
│ │ └── index.html
│ └── header.html
├── compare
│ ├── __init__.py
│ └── urls.py
├── web
│ ├── __init__.py
│ ├── urls.py
│ ├── headers.py
│ ├── wsgi.py
│ └── local_settings.py
├── analysis
│ ├── __init__.py
│ ├── templatetags
│ │ ├── __init__.py
│ │ └── analysis_tags.py
│ ├── forms.py
│ └── urls.py
├── submission
│ ├── __init__.py
│ └── urls.py
└── manage.py
├── analyzer
└── windows
│ ├── lib
│ ├── jsh
│ │ ├── .rnd
│ │ ├── run.bat
│ │ ├── add_javascript_hook_new.py
│ │ ├── extract_chrome_log.py
│ │ └── server.py
│ ├── __init__.py
│ ├── api
│ │ └── __init__.py
│ ├── core
│ │ ├── __init__.py
│ │ ├── startup.py
│ │ ├── packages.py
│ │ └── config.py
│ └── common
│ │ ├── __init__.py
│ │ ├── exceptions.py
│ │ ├── rand.py
│ │ ├── hashing.py
│ │ └── constants.py
│ ├── bin
│ └── execsc.exe
│ ├── dll
│ ├── cuckoomon.dll
│ ├── cuckoomon_bson.dll
│ └── cuckoomon_netlog.dll
│ └── modules
│ ├── __init__.py
│ ├── auxiliary
│ ├── __init__.py
│ ├── runningProcesses.py
│ ├── disguise.py
│ └── screenshots.py
│ └── packages
│ ├── __init__.py
│ ├── exe.py
│ ├── cpl.py
│ ├── ie.py
│ ├── msi.py
│ ├── vbs.py
│ ├── bin.py
│ ├── pdf.py
│ ├── xls.py
│ ├── ps1.py
│ ├── ppt.py
│ ├── doc.py
│ ├── python.py
│ ├── generic.py
│ ├── applet.py
│ ├── html.py
│ ├── dll.py
│ └── ie_jsh.py
├── requirements.txt
├── docs
├── book
│ └── src
│ │ ├── _images
│ │ ├── logo
│ │ │ └── cuckoo.png
│ │ ├── schemas
│ │ │ └── architecture-main.png
│ │ └── screenshots
│ │ │ ├── shared_folders.png
│ │ │ ├── windows_network.png
│ │ │ ├── fog_scheduled_job.png
│ │ │ ├── windows_registry.png
│ │ │ ├── windows_security.png
│ │ │ ├── fog_host_management.png
│ │ │ └── fog_image_management.png
│ │ ├── development
│ │ ├── index.rst
│ │ └── development_notes.rst
│ │ ├── usage
│ │ ├── index.rst
│ │ ├── clean.rst
│ │ ├── start.rst
│ │ └── results.rst
│ │ ├── introduction
│ │ ├── index.rst
│ │ └── license.rst
│ │ ├── customization
│ │ ├── index.rst
│ │ └── auxiliary.rst
│ │ ├── installation
│ │ ├── host
│ │ │ ├── index.rst
│ │ │ └── installation.rst
│ │ ├── guest
│ │ │ ├── index.rst
│ │ │ ├── cloning.rst
│ │ │ ├── agent.rst
│ │ │ ├── creation.rst
│ │ │ └── requirements.rst
│ │ ├── index.rst
│ │ └── guest_physical
│ │ │ ├── index.rst
│ │ │ ├── creation.rst
│ │ │ └── requirements.rst
│ │ └── index.rst
├── README
└── AUTHORS
├── lib
├── __init__.py
├── cuckoo
│ ├── __init__.py
│ ├── core
│ │ └── __init__.py
│ └── common
│ │ ├── __init__.py
│ │ ├── defines.py
│ │ ├── constants.py
│ │ ├── colors.py
│ │ ├── exceptions.py
│ │ └── config.py
└── maec
│ └── __init__.py
├── modules
├── __init__.py
├── auxiliary
│ └── __init__.py
├── machinery
│ ├── __init__.py
│ ├── kvm.py
│ └── esx.py
├── processing
│ ├── __init__.py
│ ├── dropped.py
│ ├── jsh.py
│ ├── runningprocessessnapshot.py
│ ├── procmemory.py
│ ├── strings.py
│ ├── targetinfo.py
│ ├── debug.py
│ ├── captipper.py
│ └── analysisinfo.py
├── reporting
│ ├── __init__.py
│ └── jsondump.py
└── signatures
│ ├── __init__.py
│ ├── DetectShellcode.py
│ ├── DetectsNewProcess.py
│ ├── creates_exe.py
│ ├── DetectDEPBypass.py
│ ├── DetectStackPivot.py
│ ├── DetectWerProcess.py
│ ├── generic_metrics.py
│ ├── DetectBufferShellcode.py
│ └── DetectDEPInHeap.py
├── tests
├── sniffer_tests.py
├── colors_tests.py
├── reporter_tests.py
├── processor_tests.py
├── database_tests.py
├── abstracts_tests.py
└── config_tests.py
├── conf
├── auxiliary.conf
├── reporting.conf
├── physical.conf
└── processing.conf
└── utils
├── db_migration
├── script.py.mako
├── alembic.ini
└── env.py
├── clean.sh
└── stats.py
/data/yara/memory/.gitignore:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/data/yara/urls/.gitignore:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/web/dashboard/__init__.py:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/data/src/binpackage/Makefile:
--------------------------------------------------------------------------------
1 | execsc.exe: execsc.c
2 | i586-mingw32msvc-cc -Wall -o $@ $<
3 |
4 |
--------------------------------------------------------------------------------
/data/peutils/UserDB.TXT:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/data/peutils/UserDB.TXT
--------------------------------------------------------------------------------
/web/static/img/next.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/img/next.png
--------------------------------------------------------------------------------
/web/static/img/prev.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/img/prev.png
--------------------------------------------------------------------------------
/web/static/img/close.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/img/close.png
--------------------------------------------------------------------------------
/web/static/img/loading.gif:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/img/loading.gif
--------------------------------------------------------------------------------
/web/templates/standalone_error.html:
--------------------------------------------------------------------------------
1 |
ERROR :-(
{{error}}
2 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/jsh/.rnd:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/analyzer/windows/lib/jsh/.rnd
--------------------------------------------------------------------------------
/web/static/graphic/cuckoo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/graphic/cuckoo.png
--------------------------------------------------------------------------------
/analyzer/windows/bin/execsc.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/analyzer/windows/bin/execsc.exe
--------------------------------------------------------------------------------
/web/static/graphic/background.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/graphic/background.png
--------------------------------------------------------------------------------
/analyzer/windows/dll/cuckoomon.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/analyzer/windows/dll/cuckoomon.dll
--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | sqlalchemy
2 | bson
3 | jinja2
4 | pymongo
5 | bottle
6 | pefile
7 | django
8 | chardet
9 | nose
10 |
--------------------------------------------------------------------------------
/data/html/img/glyphicons-halflings.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/data/html/img/glyphicons-halflings.png
--------------------------------------------------------------------------------
/docs/book/src/_images/logo/cuckoo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/logo/cuckoo.png
--------------------------------------------------------------------------------
/analyzer/windows/dll/cuckoomon_bson.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/analyzer/windows/dll/cuckoomon_bson.dll
--------------------------------------------------------------------------------
/analyzer/windows/dll/cuckoomon_netlog.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/analyzer/windows/dll/cuckoomon_netlog.dll
--------------------------------------------------------------------------------
/data/html/img/glyphicons-halflings-white.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/data/html/img/glyphicons-halflings-white.png
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/index.html:
--------------------------------------------------------------------------------
1 | {% include "analysis/behavior/_tree.html" %}
2 |
3 | {% include "analysis/behavior/_processes.html" %}
--------------------------------------------------------------------------------
/data/signature_overlay.json:
--------------------------------------------------------------------------------
1 | {
2 | "creates_exe": {
3 | "severity": 2,
4 | "alert": false,
5 | "custom_attribute": "machete"
6 | }
7 | }
8 |
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.eot:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/fonts/glyphicons-halflings-regular.eot
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.ttf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/fonts/glyphicons-halflings-regular.ttf
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.woff:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/fonts/glyphicons-halflings-regular.woff
--------------------------------------------------------------------------------
/docs/book/src/_images/schemas/architecture-main.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/schemas/architecture-main.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/shared_folders.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/shared_folders.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/windows_network.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/windows_network.png
--------------------------------------------------------------------------------
/web/static/fonts/glyphicons-halflings-regular.woff2:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/web/static/fonts/glyphicons-halflings-regular.woff2
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/fog_scheduled_job.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/fog_scheduled_job.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/windows_registry.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/windows_registry.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/windows_security.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/windows_security.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/fog_host_management.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/fog_host_management.png
--------------------------------------------------------------------------------
/docs/book/src/_images/screenshots/fog_image_management.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/7h3rAm/CuckooSploit/master/docs/book/src/_images/screenshots/fog_image_management.png
--------------------------------------------------------------------------------
/lib/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/web/compare/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
--------------------------------------------------------------------------------
/web/web/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/lib/cuckoo/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/lib/maec/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/web/analysis/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/web/submission/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/lib/cuckoo/core/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/lib/cuckoo/common/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/auxiliary/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/machinery/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/processing/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/reporting/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/modules/signatures/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/web/analysis/templatetags/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
--------------------------------------------------------------------------------
/analyzer/windows/lib/api/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/core/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_tree.html:
--------------------------------------------------------------------------------
1 | Process Tree
2 |
3 | {% for process in analysis.behavior.processtree %}
4 | {% include "analysis/behavior/_tree_process.html" %}
5 | {% endfor %}
6 |
7 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/auxiliary/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/__init__.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
--------------------------------------------------------------------------------
/tests/sniffer_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from nose.tools import assert_equals
6 |
--------------------------------------------------------------------------------
/web/templates/error.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | ERROR :-(
{{error}}
5 | {% endblock %}
--------------------------------------------------------------------------------
/web/templates/success.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | Great! :-)
{{message}}
5 | {% endblock %}
--------------------------------------------------------------------------------
/web/templates/base.html:
--------------------------------------------------------------------------------
1 | {%include "header.html" %}
2 |
3 | {% autoescape on %}
4 | {% block content %}{% endblock %}
5 | {% endautoescape %}
6 |
7 | {%include "footer.html" %}
8 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/jsh/run.bat:
--------------------------------------------------------------------------------
1 | @echo [+] Running Server
2 | @echo off
3 | start python server.py 8889
4 |
5 | @echo [+] Running MITMproxy
6 | @echo off
7 | start python "C:\Python27\scripts\mitmdump" -q -p 8888 -s "%cd%\add_javascript_hook.py" --anticache
8 |
--------------------------------------------------------------------------------
/web/templates/analysis/static/_strings.html:
--------------------------------------------------------------------------------
1 |
2 |
3 | {% for string in analysis.strings %}
4 |
{{string}}
5 | {% endfor %}
6 |
7 |
--------------------------------------------------------------------------------
/docs/book/src/development/index.rst:
--------------------------------------------------------------------------------
1 | .. Development chapter frontpage
2 |
3 | Development
4 | ===========
5 |
6 | This chapter explains how to write Cuckoo's code and how to contribute.
7 |
8 | .. toctree::
9 |
10 | development_notes
11 | code_style
12 |
--------------------------------------------------------------------------------
/docs/book/src/usage/index.rst:
--------------------------------------------------------------------------------
1 | .. Usage chapter frontpage
2 |
3 | Usage
4 | =====
5 |
6 | This chapter explains how to use Cuckoo.
7 |
8 | .. toctree::
9 |
10 | start
11 | submit
12 | web
13 | api
14 | dist
15 | packages
16 | results
17 | clean
18 | utilities
19 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/exceptions.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | class CuckooError(Exception):
6 | pass
7 |
8 | class CuckooPackageError(Exception):
9 | pass
--------------------------------------------------------------------------------
/data/yara/memory/index_memory.yar:
--------------------------------------------------------------------------------
1 | // Copyright (C) 2010-2014 Cuckoo Foundation.
2 | // This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | // See the file 'docs/LICENSE' for copying permission.
4 |
5 | // The contents of this file are Yara rules processed by procmemory.py processing
6 | // module. Add your signatures here.
--------------------------------------------------------------------------------
/data/html/sections/errors.html:
--------------------------------------------------------------------------------
1 | {% if results.debug.errors %}
2 |
3 |
Errors
4 |
5 |
6 |
7 | {% for error in results.debug.errors %}
8 | - {{error}}
9 | {% endfor %}
10 |
11 |
12 | {% endif %}
--------------------------------------------------------------------------------
/web/dashboard/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
4 |
5 | from django.conf.urls import patterns, url
6 |
7 | urlpatterns = patterns("",
8 | url(r"^$", "dashboard.views.index"),
9 | )
10 |
--------------------------------------------------------------------------------
/docs/book/src/introduction/index.rst:
--------------------------------------------------------------------------------
1 | .. Introduction chapter frontpage
2 |
3 | Introduction
4 | ============
5 |
6 | This is an introductory chapter to Cuckoo Sandbox.
7 | It explains some basic malware analysis concepts, what's Cuckoo and how it can fit
8 | in malware analysis.
9 |
10 | .. toctree::
11 |
12 | sandboxing
13 | what
14 | license
15 |
16 |
--------------------------------------------------------------------------------
/data/html/error.html:
--------------------------------------------------------------------------------
1 | {% extends "base-web.html" %}
2 | {% block content %}
3 |
6 |
7 |
8 | Error: {{error}}
9 |
10 |
11 | {% endblock %}
--------------------------------------------------------------------------------
/web/submission/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from django.conf.urls import patterns, url
6 |
7 | urlpatterns = patterns("",
8 | url(r"^$", "submission.views.index"),
9 | url(r"status/(?P\d+)/$", "submission.views.status"),
10 | )
11 |
--------------------------------------------------------------------------------
/tests/colors_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from nose.tools import assert_equals
6 |
7 | from lib.cuckoo.common.colors import color
8 |
9 |
10 | def test_return_text():
11 | """Test colorized text contains the input string."""
12 | assert "foo" in color("foo", 11)
--------------------------------------------------------------------------------
/docs/book/src/customization/index.rst:
--------------------------------------------------------------------------------
1 | .. Customization chapter frontpage
2 |
3 | Customization
4 | =============
5 |
6 | This chapter explains how to customize Cuckoo.
7 | Cuckoo is written in a modular architecture built to be as customizable as it can,
8 | to fit the needs of all users.
9 |
10 | .. toctree::
11 |
12 | auxiliary
13 | machinery
14 | packages
15 | processing
16 | signatures
17 | reporting
18 |
--------------------------------------------------------------------------------
/lib/cuckoo/common/defines.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | REG_NONE = 0
6 | REG_SZ = 1
7 | REG_EXPAND_SZ = 2
8 | REG_BINARY = 3
9 | REG_DWORD_LITTLE_ENDIAN = 4
10 | REG_DWORD = 4
11 | REG_DWORD_BIG_ENDIAN = 5
12 |
--------------------------------------------------------------------------------
/modules/machinery/kvm.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.cuckoo.common.abstracts import LibVirtMachinery
6 |
7 | class KVM(LibVirtMachinery):
8 | """Virtualization layer for KVM based on python-libvirt."""
9 |
10 | # Set KVM connection string.
11 | dsn = "qemu:///system"
12 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/exe.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Exe(Package):
8 | """EXE analysis package."""
9 |
10 | def start(self, path):
11 | args = self.options.get("arguments")
12 | return self.execute(path, args)
13 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/rand.py:
--------------------------------------------------------------------------------
1 | import random
2 | import string
3 |
4 | def random_string(minimum, maximum=None):
5 | if maximum is None:
6 | maximum = minimum
7 |
8 | count = random.randint(minimum, maximum)
9 | return "".join(random.choice(string.ascii_letters) for x in xrange(count))
10 |
11 | def random_integer(digits):
12 | start = 10 ** (digits - 1)
13 | end = (10 ** digits) - 1
14 | return random.randint(start, end)
15 |
--------------------------------------------------------------------------------
/data/html/success.html:
--------------------------------------------------------------------------------
1 | {% extends "base-web.html" %}
2 | {% block content %}
3 |
6 |
7 |
8 |
GOOD! File {{submitfile}} was submitted for analysis with Task ID
{{taskid}}.
9 |
10 |
11 | {% endblock %}
--------------------------------------------------------------------------------
/docs/book/src/installation/host/index.rst:
--------------------------------------------------------------------------------
1 | ==================
2 | Preparing the Host
3 | ==================
4 |
5 | Even though it's reported to run on other operating systems too, Cuckoo is
6 | originally supposed to run on a *GNU/Linux* native system.
7 | For the purpose of this documentation, we chose **latest Ubuntu LTS** as
8 | reference system for the commands examples.
9 |
10 | .. toctree::
11 |
12 | requirements
13 | installation
14 | configuration
15 |
--------------------------------------------------------------------------------
/web/manage.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python
2 | # Copyright (C) 2010-2015 Cuckoo Foundation.
3 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
4 | # See the file 'docs/LICENSE' for copying permission.
5 |
6 | import os
7 | import sys
8 |
9 | if __name__ == "__main__":
10 | os.environ.setdefault("DJANGO_SETTINGS_MODULE", "web.settings")
11 |
12 | from django.core.management import execute_from_command_line
13 |
14 | execute_from_command_line(sys.argv)
15 |
--------------------------------------------------------------------------------
/data/src/binpackage/execsc.c:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 |
5 | int main (int argc, char ** argv) {
6 | int fd;
7 | char buf[2048] = {0};
8 |
9 | if (argc < 2) return 1;
10 |
11 | // read in shellcode from analysis target file
12 | fd = open(argv[1], 0);
13 | read(fd, buf, 2048);
14 | close(fd);
15 |
16 | // jump into shellcode
17 | int (*func)();
18 | func = (int (*)()) buf;
19 | (int)(*func)();
20 |
21 | return 0;
22 | }
23 |
24 |
--------------------------------------------------------------------------------
/data/html/js/functions.js:
--------------------------------------------------------------------------------
1 | function showHide(id, lbl) {
2 | var e = document.getElementById(id);
3 |
4 | if (lbl !== "undefined")
5 | var l = document.getElementById(lbl);
6 |
7 | if(e.style.display == "none") {
8 | e.style.display = "block";
9 | if (l) {
10 | l.innerHTML = "Collapse";
11 | }
12 | }
13 | else {
14 | e.style.display = "none";
15 | if (l)
16 | l.innerHTML = "Expand";
17 | }
18 | }
19 |
--------------------------------------------------------------------------------
/conf/auxiliary.conf:
--------------------------------------------------------------------------------
1 | [sniffer]
2 | # Enable or disable the use of an external sniffer (tcpdump) [yes/no].
3 | enabled = yes
4 |
5 | # Specify the path to your local installation of tcpdump. Make sure this
6 | # path is correct.
7 | tcpdump = /usr/sbin/tcpdump
8 |
9 | # Specify the network interface name on which tcpdump should monitor the
10 | # traffic. Make sure the interface is active.
11 | interface = vboxnet0
12 |
13 | # Specify a Berkeley packet filter to pass to tcpdump.
14 | # bpf = not arp
15 |
--------------------------------------------------------------------------------
/web/compare/urls.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file "docs/LICENSE" for copying permission.
4 |
5 | from django.conf.urls import patterns, url
6 |
7 | urlpatterns = patterns("",
8 | url(r"^(?P\d+)/$", "compare.views.left"),
9 | url(r"^(?P\d+)/(?P\d+)/$", "compare.views.both"),
10 | url(r"^(?P\d+)/(?P\w+)/$", "compare.views.hash"),
11 | )
12 |
--------------------------------------------------------------------------------
/web/templates/submission/complete.html:
--------------------------------------------------------------------------------
1 | {% extends "base.html" %}
2 | {% block content %}
3 | 
4 | Submission complete!
5 | The following tasks were added successfully:
6 | {% for task in tasks %}
7 |
{{task}}
8 | {% endfor %}.
9 | Click on the links to monitor the status of the submission.
10 |
11 | {% endblock %}
12 |
--------------------------------------------------------------------------------
/data/html/sections/screenshots.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
Screenshots
4 |
5 | {% if results.screenshots %}
6 | {% for shot in results.screenshots %}
7 |
8 | {% endfor %}
9 | {% else %}
10 | No screenshots available.
11 | {% endif %}
12 |
13 |
--------------------------------------------------------------------------------
/web/analysis/forms.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from django import forms
6 |
7 | from submission.models import Comment, Tag
8 |
9 | class CommentForm(forms.ModelForm):
10 | class Meta:
11 | model = Comment
12 | fields = ["message"]
13 |
14 | class TagForm(forms.ModelForm):
15 | class Meta:
16 | model = Tag
17 | fields = ["name"]
18 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_tree_process.html:
--------------------------------------------------------------------------------
1 |
2 | {{process.name}} {{process.pid}}
3 | {% if process.children %}
4 |
5 | {% for child in process.children %}
6 | {% with process=child template_name="analysis/behavior/_tree_process.html" %}
7 | {% include template_name %}
8 | {% endwith %}
9 | {% endfor %}
10 |
11 | {% endif %}
12 |
13 |
--------------------------------------------------------------------------------
/docs/book/src/installation/guest/index.rst:
--------------------------------------------------------------------------------
1 | ===================
2 | Preparing the Guest
3 | ===================
4 |
5 | At this point you should have configured the Cuckoo host component and you
6 | should have designed and defined the number and the names of the virtual
7 | machines you are going to use for malware execution.
8 |
9 | Now it's time to create such machines and to configure them properly.
10 |
11 | .. toctree::
12 |
13 | creation
14 | requirements
15 | network
16 | agent
17 | saving
18 | cloning
19 |
20 |
--------------------------------------------------------------------------------
/web/templates/analysis/overview/_url.html:
--------------------------------------------------------------------------------
1 |
2 | URL Details
3 |
4 |
5 |
6 |
7 | | URL |
8 |
9 |
10 |
11 |
12 | | {{analysis.target.url}} |
13 |
14 |
15 |
16 |
17 |
--------------------------------------------------------------------------------
/data/html/sections/javascript_hooks.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
JavaScript Hooks
4 |
5 | {% if results.jsh and results.jsh.has_jsh_log %}
6 |
7 | {% for res in results.jsh.output %}
8 |
9 | | {{ res }} |
10 |
11 | {% endfor %}
12 |
13 | {% else %}
14 | Nothing to display.
15 | {% endif %}
16 |
17 |
--------------------------------------------------------------------------------
/docs/book/src/installation/index.rst:
--------------------------------------------------------------------------------
1 | .. Installation chapter frontpage
2 |
3 | Installation
4 | ============
5 |
6 | This chapter explains how to install Cuckoo.
7 |
8 | .. note::
9 |
10 | This documentation refers to *Host* as the underlying operating systems on
11 | which you are running Cuckoo (generally being a GNU/Linux distribution) and
12 | to *Guest* as the Windows virtual machine used to run the isolated analysis.
13 |
14 | .. toctree::
15 |
16 | host/index
17 | guest/index
18 | guest_physical/index
19 | upgrade
20 |
21 |
--------------------------------------------------------------------------------
/lib/cuckoo/common/constants.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 |
7 | _current_dir = os.path.abspath(os.path.dirname(__file__))
8 | CUCKOO_ROOT = os.path.normpath(os.path.join(_current_dir, "..", "..", ".."))
9 |
10 | CUCKOO_VERSION = "1.2"
11 | CUCKOO_GUEST_PORT = 8000
12 | CUCKOO_GUEST_INIT = 0x001
13 | CUCKOO_GUEST_RUNNING = 0x002
14 | CUCKOO_GUEST_COMPLETED = 0x003
15 | CUCKOO_GUEST_FAILED = 0x004
16 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/cpl.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class CPL(Package):
8 | """Control Panel Applet analysis package."""
9 | PATHS = [
10 | ("SystemRoot", "system32", "control.exe"),
11 | ]
12 |
13 | def start(self, path):
14 | control = self.get_path("control.exe")
15 | return self.execute(control, "\"%s\"" % path)
16 |
--------------------------------------------------------------------------------
/web/templates/analysis/overview/_screenshots.html:
--------------------------------------------------------------------------------
1 |
2 | Screenshots
3 | {% if analysis.shots %}
4 |
5 | {% for shot in analysis.shots %}
6 |
7 |
8 |
9 | {% endfor %}
10 |
11 | {% else %}
12 | No screenshots available.
13 | {% endif %}
14 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_yarascan.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | | Owner |
5 | Rule |
6 | Hexdump |
7 |
8 |
9 |
10 | {% for x in analysis.memory.yarascan.data %}
11 |
12 | | {{x.owner}} |
13 | {{x.rule}} |
14 | {{x.hexdump}} |
15 |
16 | {% endfor %}
17 |
18 |
19 |
--------------------------------------------------------------------------------
/web/templates/analysis/network/_http.html:
--------------------------------------------------------------------------------
1 | HTTP Requests
2 | {% if analysis.network.http %}
3 |
4 |
5 | | URI |
6 | Data |
7 |
8 | {% for request in analysis.network.http %}
9 |
10 | | {{request.uri}} |
11 | {{request.data}} |
12 |
13 | {% endfor %}
14 |
15 | {% else %}
16 | No HTTP requests performed.
17 | {% endif %}
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/ie.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class IE(Package):
8 | """Internet Explorer analysis package."""
9 | PATHS = [
10 | ("ProgramFiles", "Internet Explorer", "iexplore.exe"),
11 | ]
12 |
13 | def start(self, url):
14 | iexplore = self.get_path("Internet Explorer")
15 | return self.execute(iexplore, "\"%s\"" % url)
16 |
--------------------------------------------------------------------------------
/docs/book/src/installation/guest_physical/index.rst:
--------------------------------------------------------------------------------
1 | ======================================
2 | Preparing the Guest (Physical Machine)
3 | ======================================
4 |
5 | At this point you should have configured the Cuckoo host component and you
6 | should have designed and defined the number and the names of the physical
7 | machines you are going to use for malware execution.
8 |
9 | Now it's time to create such machines and to configure them properly.
10 |
11 | .. toctree::
12 |
13 | creation
14 | requirements
15 | network
16 | ../guest/agent
17 | saving
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/msi.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | class Msi(Package):
8 | """MSI analysis package."""
9 |
10 | PATHS = [
11 | ("SystemRoot", "system32", "msiexec.exe"),
12 | ]
13 |
14 | def start(self, path):
15 | msi_path = self.get_path("msiexec.exe")
16 | msi_args = "/I \"{0}\"".format(path)
17 | return self.execute(msi_path, msi_args)
18 |
--------------------------------------------------------------------------------
/docs/book/src/installation/guest/cloning.rst:
--------------------------------------------------------------------------------
1 | ===========================
2 | Cloning the Virtual Machine
3 | ===========================
4 |
5 | In case you planned to use more than one virtual machine, there's no need to
6 | repeat all the steps done so far: you can clone it. In this way you'll have
7 | a copy of the original virtualized Windows with all requirements already
8 | installed.
9 |
10 | The new virtual machine will also contain all the settings of the original one,
11 | which is not good. Now you need to proceed repeating the steps explained in
12 | :doc:`network`, :doc:`agent` and :doc:`saving` for this new machine.
13 |
--------------------------------------------------------------------------------
/tests/reporter_tests.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | import os
6 | import tempfile
7 | from nose.tools import assert_equals
8 |
9 | from lib.cuckoo.common.abstracts import Report
10 | from lib.cuckoo.common.config import Config
11 |
12 |
13 | class ReportMock(Report):
14 | def run(self, data):
15 | return
16 |
17 | class ReportAlterMock(Report):
18 | """Corrupts results dict."""
19 | def run(self, data):
20 | data['foo'] = 'notbar'
21 | return
22 |
--------------------------------------------------------------------------------
/web/templates/analysis/network/_hosts.html:
--------------------------------------------------------------------------------
1 |
2 | Hosts
3 | {% if analysis.network.hosts %}
4 |
5 |
6 | | IP |
7 |
8 | {% for host in analysis.network.hosts %}
9 |
10 | {% if host|slice:":7" != "192.168" %}
11 | | {{host}} |
12 | {% endif %}
13 |
14 | {% endfor %}
15 |
16 | {% else %}
17 | No hosts contacted.
18 | {% endif %}
19 |
20 |
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_callbacks.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | | Type |
5 | Callback |
6 | Module |
7 | Details |
8 |
9 |
10 |
11 | {% for x in analysis.memory.callbacks.data %}
12 |
13 | | {{x.type}} |
14 | {{x.callback}} |
15 | {{x.module}} |
16 | {{x.details}} |
17 |
18 | {% endfor %}
19 |
20 |
21 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/vbs.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 |
7 | # Originally proposed by kidrek:
8 | # https://github.com/cuckoobox/cuckoo/pull/136
9 |
10 | class VBS(Package):
11 | """VBS analysis package."""
12 | PATHS = [
13 | ("SystemRoot", "system32", "wscript.exe"),
14 | ]
15 |
16 | def start(self, path):
17 | wscript = self.get_path("WScript")
18 | return self.execute(wscript, "\"%s\"" % path)
19 |
--------------------------------------------------------------------------------
/web/templates/analysis/network/_irc.html:
--------------------------------------------------------------------------------
1 | IRC traffic
2 | {% if analysis.network.irc %}
3 |
4 |
5 | | Command |
6 | Params |
7 | Type |
8 |
9 | {% for irc in analysis.network.irc %}
10 |
11 | | {{irc.command}} |
12 | {{irc.params}} |
13 | {{irc.type}} |
14 |
15 | {% endfor %}
16 |
17 | {% else %}
18 | No IRC requests performed.
19 | {% endif %}
--------------------------------------------------------------------------------
/web/templates/analysis/memory/_malfind.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | | PID |
5 | Process Name |
6 | Start |
7 | Tag |
8 |
9 |
10 |
11 | {% for mal in analysis.memory.malfind.data %}
12 |
13 | | {{mal.process_id}} |
14 | {{mal.process_name}} |
15 | {{mal.vad_start}} |
16 | {{mal.vad_tag}} |
17 |
18 | {% endfor %}
19 |
20 |
21 |
--------------------------------------------------------------------------------
/web/analysis/templatetags/analysis_tags.py:
--------------------------------------------------------------------------------
1 | from django.template.defaultfilters import register
2 |
3 | @register.filter("mongo_id")
4 | def mongo_id(value):
5 | """Retrieve _id value.
6 | @todo: it will be removed in future.
7 | """
8 | if isinstance(value, dict):
9 | if value.has_key("_id"):
10 | value = value["_id"]
11 |
12 | # Return value
13 | return unicode(value)
14 |
15 | @register.filter("is_dict")
16 | def is_dict(value):
17 | """Checks if value is an instance of dict"""
18 | return isinstance(value, dict)
19 |
20 | @register.filter
21 | def get_item(dictionary, key):
22 | return dictionary.get(key, "")
23 |
--------------------------------------------------------------------------------
/analyzer/windows/lib/common/hashing.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | BUFSIZE = 1024*1024
6 |
7 |
8 | def hash_file(method, path):
9 | """Calculates an hash on a file by path.
10 | @param method: callable hashing method
11 | @param path: file path
12 | @return: computed hash string
13 | """
14 | f = open(path, "rb")
15 | h = method()
16 | while True:
17 | buf = f.read(BUFSIZE)
18 | if not buf:
19 | break
20 | h.update(buf)
21 | return h.hexdigest()
22 |
--------------------------------------------------------------------------------
/analyzer/windows/modules/packages/bin.py:
--------------------------------------------------------------------------------
1 | # Copyright (C) 2010-2015 Cuckoo Foundation.
2 | # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
3 | # See the file 'docs/LICENSE' for copying permission.
4 |
5 | from lib.common.abstracts import Package
6 | from lib.api.process import Process
7 |
8 | class Shellcode(Package):
9 | """Shellcode (any x86 executable code) analysis package."""
10 |
11 | def start(self, path):
12 | p = Process()
13 | dll = self.options.get("dll")
14 | p.execute(path="bin/execsc.exe", args=path, suspended=True)
15 | p.inject(dll)
16 | p.resume()
17 | p.wait()
18 | return p.pid
19 |
--------------------------------------------------------------------------------
/docs/README:
--------------------------------------------------------------------------------
1 | README
2 |
3 | The documentation for installing, using and customizing Cuckoo Sandbox is
4 | available under different forms and formats.
5 |
6 | Under "docs/book/" you can find the complete Cuckoo Sandbox Book in three
7 | different formats:
8 | * HTML
9 | * PDF
10 | * Text
11 |
12 | Under "docs/books/src" you'll find the Sphinx sources used to build the book.
13 |
14 | Under "epydoc/" you'll find the Python documentation of Cuckoo's libs and apis
15 | generated by Epydoc. This directory contains two sub-directories: "host" and
16 | "guest", containing references for Cuckoo's Host and Guest components
17 | respectively.
18 |
--------------------------------------------------------------------------------
/web/templates/analysis/behavior/_chunk.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | | Time |
5 | API |
6 | Arguments |
7 | Status |
8 | Return |
9 | Repeated |
10 |
11 |
12 |
13 | {% for call in chunk.calls %}
14 |
15 | {% include "analysis/behavior/_api_call.html" %}
16 |
17 | {% endfor %}
18 |
19 |
20 |
--------------------------------------------------------------------------------
/web/templates/analysis/procmemory/index.html:
--------------------------------------------------------------------------------
1 | {% if analysis.procmemory %}
2 |