Application Architecture

graph TD
    LITTERBOX_INTERFACE[LitterBox Interface] --> TARGETED_PAYLOAD{Targeted Payload}
    
    TARGETED_PAYLOAD --> FILE_UPLOAD[File Upload]
    TARGETED_PAYLOAD --> PID_INPUT[Process ID]
    
    FILE_UPLOAD --> FILE_HANDLER[File Processing<br/>Hash Calculation<br/>Type Detection<br/>Metadata Extraction]
    PID_INPUT --> PID_VALIDATOR[Process Validation<br/>PID Verification<br/>Access Check]
    
    FILE_HANDLER --> TYPE_ROUTER{File Type}
    
    TYPE_ROUTER --> PE_EXT[.exe .dll]
    TYPE_ROUTER --> SYS_EXT[.sys]
    TYPE_ROUTER --> OFFICE_EXT[.docx .xlsx]
    TYPE_ROUTER --> LNK_EXT[.lnk]
    
    PE_EXT --> PE_ANALYSIS[PE Analysis<br/>Section Parsing<br/>Import Analysis<br/>Runtime Detection Go/Rust<br/>Entropy Calculation]
    
    SYS_EXT --> DRIVER_ANALYSIS[HolyGrail BYOVD<br/>Policy Validation<br/>Vulnerability Check]
    
    OFFICE_EXT --> OFFICE_ANALYSIS[Office Macro Analysis<br/>VBA Parsing<br/>Threat Patterns]
    
    LNK_EXT --> LNK_ANALYSIS[LNK Forensics<br/>Target Extraction<br/>Metadata Analysis]
    
    PE_ANALYSIS --> ANALYSIS_ENGINE[Analysis Manager<br/>Tool Orchestration<br/>Result Aggregation]
    PID_VALIDATOR --> DYNAMIC_ANALYZERS
    
    ANALYSIS_ENGINE --> STATIC_ANALYZERS[Static Analysis Tools<br/>YARA Static Scanner<br/>CheckPLZ Threat Detector<br/>Stringnalyzer Extractor]
    
    ANALYSIS_ENGINE --> DYNAMIC_ANALYZERS[Dynamic Analysis Tools<br/>YARA Dynamic Scanner<br/>PE-Sieve Injection Detector<br/>Moneta Memory Analyzer<br/>Patriot Behavior Monitor<br/>Hunt Sleeping Beacons<br/>RedEdr ETW Monitor]
    
    STATIC_ANALYZERS --> RISK_ENGINE[Risk Calculator<br/>Multi-factor Scoring<br/>Threat Classification<br/>Runtime-aware Assessment]
    DYNAMIC_ANALYZERS --> RISK_ENGINE
    DRIVER_ANALYSIS --> RISK_ENGINE
    OFFICE_ANALYSIS --> RISK_ENGINE
    LNK_ANALYSIS --> RISK_ENGINE
    
    RISK_ENGINE --> RESULT_PROCESSOR[Result Handler<br/>Data Formatting<br/>Report Generation<br/>Template Rendering]
    
    RESULT_PROCESSOR --> OUTPUT{Output Format}
    
    OUTPUT -->|Web Interface| WEB_DISPLAY[Web Dashboard<br/>Interactive Results<br/>HTML Templates]
    OUTPUT -->|API Response| JSON_API[JSON API<br/>Structured Data<br/>REST Endpoints]
    OUTPUT -->|Report Export| FILE_EXPORT[Report Export<br/>HTML Reports<br/>Downloadable Files]
    
    subgraph STORAGE[Data Storage]
        FILE_STORE[(Upload Folder<br/>Original Samples)]
        RESULT_STORE[(Results Folder<br/>Analysis JSON)]
        CONFIG_STORE[(Configuration<br/>YAML Settings)]
        SIGNATURE_STORE[(MalAPI Database<br/>YARA Rules)]
        HOLYGRAIL_POLICIES[(HolyGrail Policies<br/>Driver Policy Files)]
        FUZZY_DB[(FuzzyHash DB<br/>Similarity Index)]
    end
    
    FILE_HANDLER -.-> FILE_STORE
    RESULT_PROCESSOR -.-> RESULT_STORE
    ANALYSIS_ENGINE -.-> CONFIG_STORE
    STATIC_ANALYZERS -.-> SIGNATURE_STORE
    DRIVER_ANALYSIS -.-> HOLYGRAIL_POLICIES
    SIMILARITY -.-> FUZZY_DB
    
    subgraph ADVANCED[Specialized Analysis]
        SIMILARITY[FuzzyHash Analyzer<br/>Similarity Comparison<br/>Variant Detection]
        BASELINE[Blender Analyzer<br/>System Comparison<br/>IOC Correlation]
    end
    
    RESULT_PROCESSOR -.-> ADVANCED
    
    subgraph MANAGEMENT[System Management]
        HEALTH[Health Monitor<br/>Tool Validation<br/>System Status]
        CLEANUP[Cleanup Service<br/>File Management<br/>Storage Maintenance]
    end
    
    LITTERBOX_INTERFACE -.-> MANAGEMENT
    
    classDef interface fill:#1e40af,stroke:#1d4ed8,stroke-width:2px,color:#fff
    classDef processing fill:#059669,stroke:#047857,stroke-width:2px,color:#fff
    classDef analysis fill:#eab308,stroke:#ca8a04,stroke-width:2px,color:#000
    classDef orchestration fill:#7c3aed,stroke:#6d28d9,stroke-width:2px,color:#fff
    classDef outputs fill:#dc2626,stroke:#b91c1c,stroke-width:2px,color:#fff
    classDef storage fill:#92400e,stroke:#78350f,stroke-width:2px,color:#fff
    classDef specialized fill:#ec4899,stroke:#be185d,stroke-width:2px,color:#fff
    classDef management fill:#6b7280,stroke:#374151,stroke-width:2px,color:#fff
    
    class LITTERBOX_INTERFACE,TARGETED_PAYLOAD interface
    class FILE_UPLOAD,PID_INPUT,FILE_HANDLER,PID_VALIDATOR,TYPE_ROUTER,PE_EXT,SYS_EXT,OFFICE_EXT,LNK_EXT processing
    class PE_ANALYSIS,DRIVER_ANALYSIS,OFFICE_ANALYSIS,LNK_ANALYSIS,STATIC_ANALYZERS,DYNAMIC_ANALYZERS analysis
    class ANALYSIS_ENGINE,RISK_ENGINE,RESULT_PROCESSOR,OUTPUT orchestration
    class WEB_DISPLAY,JSON_API,FILE_EXPORT outputs
    class STORAGE,FILE_STORE,RESULT_STORE,CONFIG_STORE,SIGNATURE_STORE,HOLYGRAIL_POLICIES,FUZZY_DB storage
    class ADVANCED,SIMILARITY,BASELINE specialized
    class MANAGEMENT,HEALTH,CLEANUP management

Loading