Package: reversinglabs-sdk-py2
ReversingLabsSDKA Python SDK for ReversingLabs REST services (TitaniumCloud and appliances) - Python 2 version.The idea behind this SDK is to enable easier out-of-the-box development of software integrations and automation services that need to interact with ReversingLabs.The SDK consists of several modules, where each module represents one ReversingLabs service or ReversingLabs TitaniumCloud.ReversingLabsSDKModule: a1000Class A1000ParametersMethodsModule: ticloudCommon ParametersClass FileReputationClass AVScannersClass FileAnalysisClass RHA1FunctionalSimilarityClass RHA1AnalyticsClass URIStatisticsClass URIIndexClass AdvancedSearchClass ExpressionSearchClass FileDownloadClass URLThreatIntelligenceClass AnalyzeURLClass FileUploadClass DynamicAnalysisClass CertificateAnalyticsClass RansomwareIndicatorsModule: tiscaleClass TitaniumScaleParametersMethodsExamplesModule: a1000A Python module representing the ReversingLabs A1000 malware analysis platform.Class:classA1000(object)def__init__(self,host,username=None,password=None,token=None,fields=__FIELDS,wait_time_seconds=2,retries=10,verify=True,proxies=None,user_agent=DEFAULT_USER_AGENT):Parameters:host- A1000 addressusername- A1000 usernamepassword- A1000 passwordtoken- A1000 user token for the REST APIfields- optional fields that will be returned in the analysis reportwait_time_seconds- wait time between each report fetching retryretries- number of report fetching retriesverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringNOTE!The default means of authorization on the ReversingLabs A1000 REST API is the token.If username and password are used instead, a token fetching request will be done so the token can be used in further actions without the user explicitly providing the token.Class methods:configuration_dumpReturns the configuration of the instantiated A1000 objecttest_connectionCreates a request towards the A1000 Check Status API to test the connection with A1000upload_sample_from_pathAccepts a file path string and returns a response containing the analysis task IDupload_sample_from_fileAccepts a file open in 'rb' mode and returns a response containing the analysis task IDget_resultsAccepts a list of hashes and returns a summary JSON report for each of themThis method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyupload_sample_and_get_resultsAccepts a file path string or an opened file in 'rb' mode for file upload and returns an analysis report responseThis method combines uploading a sample and obtaining the analysis resultsThe result fetching action of this method utilizes the set number of retries and wait time in seconds to time
out if the analysis results are not readyget_classificationAccepts one or more sample hashes and returns their classificationreanalyze_samplesAccepts a single hash or a list of hashes of the same type and reanalyzes the corresponding samplesget_extracted_filesAccepts a sample hash and returns a list of all files TitaniumCore engine extracted from the requested sample during static analysisdownload_extracted_filesAccepts a single hash string and returns a downloadable archive file containing files extracted from the desired sampledelete_samplesAccepts a single hash string or a list of hashes and deletes the corresponding samples from A1000download_sampleAccepts a single hash string and returns a downloadable sampleadvanced_searchAccepts a search query string and performs advanced search for local samples on A1000Returns only one defined page of results using one requestadvanced_search_aggregatedAccepts a search query string and performs advanced search for local samples on A1000Returns a list of results aggregated through multiple paginated requestsModule: ticloudA Python module representing the ReversingLabs TitaniumCloud API-s.Each class in this module represents one TitaniumCloud API and can be instantiated using the same set of parameters:def__init__(self,host,username,password,verify=True,proxies=None,user_agent=DEFAULT_USER_AGENT,allow_none_return=False)Parameters:host- TitaniumCloud addressusername- TitaniumCloud usernamepassword- TitaniumCloud passwordverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringallow_none_return- if set toTrue,404response codes will returnNoneinstead ofNotFoundErrorClass:classFileReputation(TiCloudAPI)Methods:get_file_reputationAccepts a hash string or a list of hash strings and returns file reputationHash strings in a passed list must all be of the same hashing algorithmClass:classAVScanners(TiCloudAPI)Methods:get_scan_resultsAccepts a hash string or a list of hash strings and returns AV scanner resultsHash strings in a passed list must all be of the same hashing algorithmClass:classFileAnalysis(TiCloudAPI)Methods:get_analysis_resultsAccepts a hash string or a list of hash strings and returns extended file analysisextract_uri_list_from_reportAccepts a list of entries from the FileAnalysis report and returns a list of URI-s from those entries.get_file_typeAccepts a sample hash and returns the file type stringClass:classRHA1FunctionalSimilarity(TiCloudAPI)Methods:get_similar_hashesAccepts a hash string and returns a list of functionally similar hashesReturns only one defined page of results using one requestget_similar_hashes_aggregatedAccepts a hash string and returns a list of functionally similar hashesReturns a list of results aggregated through multiple paginated requestsClass:classRHA1Analytics(TiCloudAPI)Methods:get_rha1_analyticsAccepts one or more hash strings and returns a count of functionally similar hashes grouped by classificationClass:classURIStatistics(TiCloudAPI)Methods:get_uri_statisticsAccepts a URI string and returns a count of files associated with that URI grouped by classificationClass:classURIIndex(TiCloudAPI)Methods:get_uri_indexAccepts a URI string and returns a list of files associated with this URIReturns only one defined page of results using one requestget_uri_index_aggregatedAccepts a URI string and returns a list of files associated with this URIReturns a list of results aggregated through multiple paginated requestsClass:classAdvancedSearch(TiCloudAPI)Methods:searchAccepts a search query string and performs advanced search on the APIReturns only one defined page of results using one requestsearch_aggregatedAccepts a search query string and performs advanced search on the APIReturns a list of results aggregated through multiple paginated requestsClass:classExpressionSearch(TiCloudAPI)Methods:searchAccepts a list containing the search query and performs expression search on the APIReturns only one defined page of results using one requestsearch_aggregatedAccepts a list containing the search query and performs expression search on the APIReturns a list of results aggregated through multiple paginated requestsClass:classFileDownload(TiCloudAPI)Methods:get_download_statusAccepts a hash string and returns the sample's availability for downloaddownload_sampleAccepts a hash string and downloads the related sample from TitaniumCloudClass:classURLThreatIntelligence(TiCloudAPI)Methods:get_url_reportAccepts a URL string and returns detailed URL analysis infoget_downloaded_filesAccepts a URL string and returns a list of files downloaded from that URLget_latest_url_analysis_feedReturns the latest URL analysis reportsReturns only one defined page of results using one requestget_latest_url_analysis_feed_aggregatedReturns the latest URL analysis reportsReturns a list of results aggregated through multiple paginated requestsget_url_analysis_feed_from_dateAccepts time format and a start time and returns URL analysis reports from that defined time onwardReturns only one defined page of results using one requestget_url_analysis_feed_from_date_aggregatedAccepts time format and a start time and returns URL analysis reports from that defined time onwardReturns a list of results aggregated through multiple paginated requestsClass:classAnalyzeURL(TiCloudAPI)Methods:submit_urlSends a URL string for analysis and returns an analysis task IDClass:classFileUpload(TiCloudAPI)Methods:upload_sample_from_pathAccepts a file path string and uploads the desired file to the File Upload APIupload_sample_from_fileAccepts an open file handle and uploads the desired file to the File Upload APIClass:classDynamicAnalysis(TiCloudAPI)Methods:detonate_sampleSubmits a sample available in the cloud for dynamic analysis and returns processing infoThe sample needs to be available in TitaniumCloud beforehandget_dynamic_analysis_resultsReturns dynamic analysis results for a desired sampleThe analysis of the selected sample must be finished for the results to be availableClass:classCertificateAnalytics(TiCloudAPI)Methods:get_certificate_analyticsAccepts a certificate hash thumbprint (hash string) and returns certificate analytics resultsClass:classRansomwareIndicators(TiCloudAPI)Methods:get_indicatorsAccepts a list of indicator type strings and integers for historical hours, health check and returning only freemium indicators. Returns indicators of ransomware and related tools.Module: tiscaleA Python module representing the ReversingLabs TitaniumScale malware analysis appliance.Class:classTitaniumScale(object)def__init__(self,host,token,wait_time_seconds=2,retries=10,verify=True,proxies=None,user_agent=DEFAULT_USER_AGENT)Parameters:host- TitaniumScale addresstoken- A1000 user token for the REST APIwait_time_seconds- wait time between each report fetching retryretries- number of report fetching retriesverify- verify SSL certificateproxies- optional proxies in useuser_agent- optional user agent stringMethods:upload_sample_from_pathAccepts a file path string for file upload and returns a response containing the analysis task URLupload_sample_from_fileAccepts a file opened in 'rb' mode for file upload and returns a response containing the analysis task URLget_resultsAccepts an analysis task URL and returns a file analysis summary or a full analysis reportThis method utilizes the set number of retries and wait time in seconds to time out if the analysis results are not readyupload_sample_and_get_resultsAccepts a file path string or an opened file in 'rb' mode for file upload and returns a file analysis summary or a full analysis reportThis method combines uploading a sample and obtaining the analysis resultsThe result obtaining action of this method utilizes the set number of retries and wait time in seconds to time out if the analysis results are not readyExamplesA1000fromReversingLabs.SDK.a1000importA1000# Using username and password for authorizationa1000=A1000(host="https://a1000.address",username="username",password="password",verify=True,wait_time_seconds=3,retries=10)response=a1000.upload_sample_and_get_results(file_path="/path/to/file.exe",retry=True,custom_filename="CustomName",tags="custom,tags,go,here",)json_report=response.json()fromReversingLabs.SDK.a1000importA1000# Using token for authorizationa1000=A1000(host="http://a1000.address",token="1js76asmklaslk288japj29s89z",verify=False,wait_time_seconds=2,retries=15)response=a1000.get_extracted_files(sample_hash="cf23df2207d99a74fbe169e3eba035e633b65d94",page_size=30)json_report=response.json()TitaniumCloudfromReversingLabs.SDK.ticloudimportFileReputation,URIStatistics,FileDownload,FileUploadhost="https://data.reversinglabs.com"username="username"password="password"user_agent="MyCustom App v0.0.1"file_reputation=FileReputation(host=host,username=username,password=password,user_agent=user_agent)reputation=file_reputation.get_file_reputation(hash_input="cf23df2207d99a74fbe169e3eba035e633b65d94",extended_results=True,show_hashes_in_results=False)uri_statistics=URIStatistics(host=host,username=username,password=password,user_agent=user_agent)statistics=uri_statistics.get_uri_statistics(uri_input="youtube.com")file_download=FileDownload(host=host,username=username,password=password,user_agent=user_agent)download=file_download.download_sample(hash_input="cf23df2207d99a74fbe169e3eba035e633b65d94")withopen("/path/to/file","wb")asfile_handle:file_handle.write(download.content)file_upload=FileUpload(host=host,username=username,password=password,user_agent=user_agent)upload=file_upload.upload_sample_from_path(file_path="/path/to/file",sample_name="Custom Sample Name",sample_domain="webdomain.com")TitaniumScalefromReversingLabs.SDK.tiscaleimportTitaniumScaletitanium_scale=TitaniumScale(host="https://tiscale.address",token="examplesecrettoken",# replace with a proper tokenverify=True,wait_time_seconds=5,retries=6)results=titanium_scale.upload_sample_and_get_results(file_source=open("/path/to/file.exe","rb"),full_report=True)