Package: quicksand
QuickSand Version 2QuickSand Python Package and Command Line ToolQuickSand is a Python-based analysis framework to analyze suspected malware documents to identify exploits in streams of different encodings or compressions. QuickSand supports documents, PDFs, Mime/Email, Postscript and other common formats. A built-in command line tool can process a single document or directory of documents.QuickSand scans within the decoded streams of documents and PDFs using Yara signatures to identify exploits or high risk active content.A hosted version is available to try without any installation atscan.tylabs.com.Files:src/quicksand/quicksand.py: Main quicksand class and CLI toolsrc/quicksand/quicksand_exe.yara: Yara rules to detect executables.src/quicksand/quicksand_exploits.yara: Yara rules to detect exploits in documents.src/quicksand/quicksand_pdf.yara: Yara rules to detect exploits in PDFs.bin/quicksand: Command line tool.requirements.txt: Python dependencieslambda/Optional AWS Lambda functionsWith Thanks to the Creators of:pdfreaderoletoolscryptographyzipfile38olefileyara-pythonyaraInstallation from Pypi using pippip3 install quicksandUpgrade from Pypi using pippip3 install --upgrade quicksandInstall from sourceIf you want to install from the source, such as the uicksand-main.zip downloaded from GitHub:pip3 install quicksand-main.zipCommand Line UsageA command line tool for quicksand to process and output json or txt results.usage: quicksand [-h] [-v] [-c] [-y] [-t TIMEOUT] [-e EXPLOIT] [-x EXE] [-a PDF] [-f {json,txt}] [-o OUT] [-p PASSWORD]
                 [-d DROPDIR]
                 document

QuickSand Document and PDF maldoc analysis tool.

positional arguments:
  document              document or directory to scan

optional arguments:
  -h, --help            show this help message and exit
  -v, --verbose         increase output verbosity
  -c, --capture         capture stream content
  -y, --yara            capture yara matched strings
  -t TIMEOUT, --timeout TIMEOUT
                        timeout in seconds
  -e EXPLOIT, --exploit EXPLOIT
                        yara exploit signatures
  -x EXE, --exe EXE     yara executable signatures
  -a PDF, --pdf PDF     yara PDF signatures
  -f {json,txt}, --format {json,txt}
                        output format
  -o OUT, --out OUT     save output to this filename
  -p PASSWORD, --password PASSWORD
                        password to decrypt ole or pdf
  -d DROPDIR, --dropdir DROPDIR
                        save objects to this directoryProcess a single filequicksand document.docProcess a directory of filesquicksand malware/Python Module UsageFile from memoryfrom quicksand.quicksand import quicksand
import pprint

qs = quicksand(data, timeout=18, strings=True)
qs.process()
pprint.pprint(qs.results)Processing using a filenamefrom quicksand.quicksand import quicksand

qs2 = quicksand("file.doc")
qs2.process()
qs.resultsProcess a Directoryfrom quicksand.quicksand import quicksand
qs = quicksand.readDir("malware")
qsReturns a dictionary of {filename:qs_results,...}.Optional initializer valuescapture: True|False return content of extracted streamsdebug: True|False print debugging messages to stdoutexploityara: Path to exploit yara rulesexecyara: Path to executable yara rulespdfyara: PDF Exploits yara rulespassword: Password for encrypted documents/PDFstimeout: Timeout processing: 0 for unlimited.ScoringDocuments are scored based on the rank value in the associated Yara signature metadata.Additionally, each signature defines whether the detected item is an exploit, a warning or a risky feature. For more information on how to interpret the results, please seehttps://scan.tylabs.com/howto.If you add your own signatures, they don't need to include the extra metadata to function.zlib issues on MacOSMacOS users may get zlib issues (PDF FlateDecode etc) due to missing OpenSSL headers since MacOs 10.4.zlib.error: Error -3 while decompressing data: unknown compression method
zlib.error: Error -3 while decompressing data: incorrect header checkOne solution is to install zlib with Brew.sh and reinstall Python 3 using pyenv:export LDFLAGS="-L/usr/local/opt/zlib/lib"
export CPPFLAGS="-I/usr/local/opt/zlib/include"
pyenv install 3.8.5Using Quicksand?Let us know@tylabsIssues and Project HomeQuickSand GitHub