Trees | Indices | Help |
|
---|
|
object --+ | lib.cuckoo.common.abstracts.Report --+ | MAEC40Report
Generates a MAEC 4.0.1 report. --Output modes (set in reporting.conf): mode = "full": Output fully mapped Actions (see maec40_mappings), including Windows Handle mapped/substituted objects, along with API call/parameter capture via Action Implementations. mode = "overview": Output only fully mapped Actions, without any Action Implementations. Default mode. mode = "api": Output only Actions with Action Implementations, but no mapped components. --Other configuration parameters: processtree = "true" | "false". Output captured ProcessTree as part of dynamic analysis MAEC Bundle. Default = "true". output_handles = "true" | "false". Output the Windows Handles used to construct the Object-Handle mappings as a separate Object Collection in the dynamic analysis MAEC Bundle. Only applicable for mode = "full" or mode = "overview". Default = "false". static = "true" | "false". Output Cuckoo static analysis (PEfile) output as a separate MAEC Bundle in the document. Default = "true". strings = "true" | "false". Output Cuckoo strings output as a separate MAEC Bundle in the document. Default = "true". virustotal = "true" | "false". Output VirusTotal output as a separate MAEC Bundle in the document. Default = "true".
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Inherited from Inherited from |
|
|||
Inherited from |
|
|||
Inherited from |
|
Writes report.
|
Create a network Action.
|
Creates a single ProcessTreeNode corresponding to a single node in the tree observed cuckoo.
|
Create and return a dictionary representing a MAEC Malware Action.
|
Creates a MAEC Action Implementation based on API call input.
|
Processes a dictionary of parameters that should be mapped to Action Arguments in the Malware Action.
|
Processes a dictionary of parameters that should be mapped to Associated Objects in the Action
|
Process any Windows Handles that may be associated with an Action. Replace Handle references with actual Object, if possible.
|
Add a new Handle/Object pairing to the Handle mappings dictionary.
|
Process any Registry Key associated with an action. Special case to handle registry Hives that may refer to Handles.
|
Process a Registry Key Handle and return the full key, recursing as necessary.
|
Process a single Associated Object mapping.
|
Helper function: returns a nested dictionary for an input list.
|
Finds and returns an API call parameter value from a list.
|
Creates the Actions corresponding to the API calls initiated by a process.
|
Creates a File object.
Requires: file object. |
Trees | Indices | Help |
|
---|
Generated by Epydoc 3.0.1 on Mon Apr 7 13:27:49 2014 | http://epydoc.sourceforge.net |