-
Notifications
You must be signed in to change notification settings - Fork 6
/
malware-2-hash.py
67 lines (52 loc) · 1.69 KB
/
malware-2-hash.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
import hashlib
import os
import json
import argparse
# By default, poll every thirty minutes
DEFAULT_POLL_TIME = 30
parser = argparse.ArgumentParser(prog = 'Malware-2-Hash',description='Script to automate the hashing and creation of malware IOCs!', epilog='Text at the bottom of help')
parser.add_argument("-f", "--filepath", help="malware file to hash")
parser.add_argument("-n", "--name", help="malware name")
args = parser.parse_args()
if args.filepath == None:
print("Argument -f (--filepath) is required!")
os._exit(0)
#Find file
if not(os.path.isfile(args.filepath)):
print("Invalid filepath! please try again")
os._exit(0)
file = args.filepath
# The size of each read from the file
BLOCK_SIZE = 65536
# Create the hash objects
md5_obj = hashlib.md5()
sha1_obj = hashlib.sha1()
sha256_obj = hashlib.sha256()
with open(file, 'rb') as f:
fileblock = f.read(BLOCK_SIZE)
while len(fileblock) > 0:
md5_obj.update(fileblock)
sha1_obj.update(fileblock)
sha256_obj.update(fileblock)
fileblock = f.read(BLOCK_SIZE)
f.close()
print("Hashes: \n MD5: {md5}\n SHA1: {sha1}\n SHA256: {sha256}\n".format(md5=md5_obj.hexdigest(), sha1=sha1_obj.hexdigest(), sha256=sha256_obj.hexdigest()))
if args.name == None:
print(os.path.basename(file))
filename = file.split(".")
name = filename[0]
else:
name = args.name
ioc = {
"name" : name,
"file_hash" : sha256_obj.hexdigest(),
"poll_time" : DEFAULT_POLL_TIME,
"MD5" : md5_obj.hexdigest(),
"SHA1" : sha1_obj.hexdigest(),
"SHA256" : sha256_obj.hexdigest()
}
json_object = json.dumps(ioc, indent=4)
with open("ioc/"+name+".json", "w") as outfile:
outfile.write(json_object)
outfile.close()
print("IOC file saved under /ioc/{name}.json".format(name=name))