search

maliceio / malice

VirusTotal Wanna Be - Now with 100% more Hipster
Apache License 2.0
1.63k stars 266 forks source link

Several plugins don't work #68

Closed unstppbl closed 5 years ago

unstppbl commented 5 years ago

Output of go version:

go version go1.10.3 linux/amd64

Output of docker version:

Client:
 Version:      18.05.0-ce-rc1
 API version:  1.37
 Go version:   go1.9.5
 Git commit:   33f00ce
 Built:        Thu Apr 26 01:05:07 2018
 OS/Arch:      linux/amd64
 Experimental: false
 Orchestrator: swarm

Server:
 Engine:
  Version:      18.05.0-ce-rc1
  API version:  1.37 (minimum version 1.12)
  Go version:   go1.9.5
  Git commit:   33f00ce
  Built:        Thu Apr 26 01:08:54 2018
  OS/Arch:      linux/amd64
  Experimental: false

Output of docker info:

Containers: 23
 Running: 1
 Paused: 0
 Stopped: 22
Images: 39
Server Version: 18.05.0-ce-rc1
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 773c489c9c1b21a6d78b5c538cd395416ec50f88
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: 949e6fa
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.17.9-200.fc28.x86_64
Operating System: Fedora 28 (Twenty Eight)
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 7.685GiB
Name: friday
ID: 5QP4:Z3UQ:TIGC:7P6K:74MB:IAET:BZAK:2GXG:BGNX:BUHU:4B63:X7LJ
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

Additional environment details (AWS, VirtualBox, physical, Docker For Mac, Docker Toolbox, docker-machine, etc.):

Steps to reproduce the issue:

  1. Install malice via rpm package
  2. Run elasticsearch with command docker run -d \ -p 9200:9200 \ -name malice-elastic \ -e ES_JAVA_OPTS="-Xms2g -Xmx2g" \ malice/elasticsearch
  3. Run malice scan shell.php

Describe the results you received:

╰$ malice scan shell.php
#### File
| Field  | Value                                                            |
| ------ | ---------------------------------------------------------------- |
| Name   | shell.php                                                        |
| Path   | shell.php                                                        |
| Size   | 24.72kB                                                          |
| MD5    | ea42a072eb9144794123989b7d2c9aee                                 |
| SHA1   | e844b8e24ce7d0ab7c50b3591189779c69705471                         |
| SHA256 | c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 |
#### VirusTotal
| Ratio      | Link         | API         | Scanned     |
|------------|--------------|-------------|-------------|
| 47% | [link](https://www.virustotal.com/file/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4/analysis/1509674703/) | Public | 2017-11-03 02:05:03 |

#### ShadowServer

 - Not found

#### NSRL Database
 - Not Found :question:

#### Yara
#### Magic
| Field       | Value                  |
|-------------|------------------------|
| Mime        | text/x-php        |
| Description | PHP script, ASCII text, with very long lines |

#### SSDeep
 - `768:nfPnl6REZCvSEa1fBodEs3m5ZVu7/7dXztH:NN1fBguYzfH`

#### TRiD
- Warning: file seems to be plain text/ASCII
- TrID is best suited to analyze binary files!
- 100.0% (.PHP) PHP source (5000/1)

#### Exiftool
| Field       | Value                |
|-------------|----------------------|
| error  | signal: killed        |

time="2018-08-01T05:30:39Z" level=fatal msg="exit status 150" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=avg
time="2018-08-01T05:30:46Z" level=fatal msg="exit status 2" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=avast
#### F-PROT
| Infected      | Result      | Engine      | Updated      |
|:-------------:|:-----------:|:-----------:|:------------:|
| false |  | 4.6.5.141 | 20180729 |

time="2018-08-01T05:31:03Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=windows_defender
time="2018-08-01T05:31:08Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=escan
time="2018-08-01T05:31:09Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=bitdefender
#### F-Secure
| Infected      | Result      | Engine      | Updated      |
|:-------------:|:-----------:|:-----------:|:------------:|
| false |  |  |  |

time="2018-08-01T05:31:22Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=clamav
#### Comodo
| Infected      | Result      | Engine      | Updated      |
|:-------------:|:-----------:|:-----------:|:------------:|
| true | Malware | 1.1 | 20180729 |

time="2018-08-01T05:31:28Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=sophos

Describe the results you expected: As you can see several plugins got killed

Additional information you deem important (e.g. issue happens only occasionally): Sometimes the scan process even

blacktop commented 5 years ago

It is strange that it is saying it got a signal killed error on a lot of them

Did you Ctrl+C malware while it was scanning?

It also looks like you might have a lot of stopped containers (from when you were running with elasticsearch being down)

You can clean up the stopped containers by running: docker container prune

blacktop commented 5 years ago

Can you clarify what you mean by: Sometimes the scan process even ?

unstppbl commented 5 years ago

Sorry, Sometimes the scan process even this is not meant to be in issue :)

I didn't do Ctrl+C.

Cleaned all the stopped containers and ran scan again:

#### File
| Field  | Value                                                            |
| ------ | ---------------------------------------------------------------- |
| Name   | shell.php                                                        |
| Path   | shell.php                                                        |
| Size   | 24.72kB                                                          |
| MD5    | ea42a072eb9144794123989b7d2c9aee                                 |
| SHA1   | e844b8e24ce7d0ab7c50b3591189779c69705471                         |
| SHA256 | c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 |
#### NSRL Database
 - Not Found :question:

#### VirusTotal
| Ratio      | Link         | API         | Scanned     |
|------------|--------------|-------------|-------------|
| 47% | [link](https://www.virustotal.com/file/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4/analysis/1509674703/) | Public | 2017-11-03 02:05:03 |

time="2018-08-02T05:10:25Z" level=fatal msg="failed to index malice/shadow_server results: failed to update sample with id: tV8L-WQBFaNqWmQ-DEv-: elastic: Error 409 (Conflict): [samples][tV8L-WQBFaNqWmQ-DEv-]: version conflict, current version [3] is different than the one provided [2] [type=version_conflict_engine_exception]" category=intel hash=e844b8e24ce7d0ab7c50b3591189779c69705471 plugin=shadow_server
#### Yara
#### Magic
| Field       | Value                  |
|-------------|------------------------|
| Mime        | text/x-php        |
| Description | PHP script, ASCII text, with very long lines |

#### SSDeep
 - `768:nfPnl6REZCvSEa1fBodEs3m5ZVu7/7dXztH:NN1fBguYzfH`

#### TRiD
- Warning: file seems to be plain text/ASCII
- TrID is best suited to analyze binary files!
- 100.0% (.PHP) PHP source (5000/1)

#### Exiftool
| Field       | Value                |
|-------------|----------------------|
| error  | signal: killed        |

time="2018-08-02T05:11:37Z" level=fatal msg="exit status 2" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=avast
time="2018-08-02T05:12:00Z" level=fatal msg="exit status 150" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=avg
time="2018-08-02T05:12:03Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=clamav
2018/08/02 05:12:05 signal: killed
time="2018-08-02T05:12:08Z" level=fatal msg="failed to index malice/fprot results: failed to update sample with id: tV8L-WQBFaNqWmQ-DEv-: elastic: Error 409 (Conflict): [samples][tV8L-WQBFaNqWmQ-DEv-]: version conflict, current version [6] is different than the one provided [5] [type=version_conflict_engine_exception]" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=fprot
#### F-Secure
| Infected      | Result      | Engine      | Updated      |
|:-------------:|:-----------:|:-----------:|:------------:|
| false |  |  |  |

time="2018-08-02T05:12:09Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=bitdefender
time="2018-08-02T05:12:09Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=escan
time="2018-08-02T05:12:21Z" level=fatal msg="failed to index malice/windows-defender results: failed to update sample with id: tV8L-WQBFaNqWmQ-DEv-: elastic: Error 409 (Conflict): [samples][tV8L-WQBFaNqWmQ-DEv-]: version conflict, current version [6] is different than the one provided [5] [type=version_conflict_engine_exception]" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=windows_defender
time="2018-08-02T05:12:27Z" level=fatal msg="signal: killed" category=av path=/malware/c213374cc1914f28bc3ff3cacbc6d30b6fd4a2c6c3b0e2f5d449268f1400feb4 plugin=sophos
blacktop commented 5 years ago

it might be you do not have enough resources in your VM to run malice. It requres a lot of RAM because of elasticsearch

please reopen if that is not the issue

changemenemo commented 5 years ago

6G of RAM for a 30MB pdf. Don't know if the size of the file has anything to do with it but so you know. still a 409 error with virustotal time="2018-11-29T00:45:02Z" level=fatal msg="failed to index malice/virustotal results: failed to update sample with id: RYrtXGcBjIpm6xqHErD5: elastic: Error 409 (Conflict): [samples][RYrtXGcBjIpm6xqHErD5]: version conflict, current version [2] is different than the one provided [1] [type=version_conflict_engine_exception]" category=intel hash= plugin=virustotal