sandbox

type AgentCfg struct {
	// Destination directory inside the guest where the agent is deployed.
	AgentDestDir string `mapstructure:"dest_dir"`
	// The sandbox binary components.
	PackageName string `mapstructure:"package_name"`
}

type Artifact struct {
	// File  name of the artifact.
	// * Memory buffers are in this format: ProcessName__PID__TID__VA__BuffSize.memfree
	// *** svchost.exe__0x2E00__0xA60__0x1A46D880000__0x77824.memfree
	// * Files dropped are in this format: ProcessName_PID_TID_FilePath__FileSize.filecreate
	// *** explorer.exe__0x2E00__0xA60__C##ProgramData##Delete.vbs__0x9855.filecreate
	Name string `json:"name"`
	// The binary content of the artifact.
	Content []byte `json:"-"`
	// The artifact kind: memfree, filecreate, ..
	Kind string `json:"kind"`
	// The SHA256 hash of the artifact.
	SHA256 string `json:"sha256"`
	// Detection contains the family name of the malware if it is malicious,
	// or clean otherwise.
	Detection string `json:"detection"`
	// The file type, i.e docx, dll, etc.
	FileType string `json:"file_type"`
}

type Capability struct {
	// Process identifier responsible for generating the capability..
	ProcessID string `json:"pid"`
	// Description describes in a few words the capability.
	Description string `json:"description"`
	// The severity of the capability: informative, suspicious, malicious, etc.
	Severity string `json:"severity"`
	// Category of the capability: Persistence, anti-analysis, etc.
	Category string `json:"category"`
	// The module that generated the capability: yara, behavior, etc.
	Module string `json:"module"`
}

type Config struct {
	LogLevel     string             `mapstructure:"log_level"`
	SharedVolume string             `mapstructure:"shared_volume"`
	EnglishWords string             `mapstructure:"english_words"`
	YaraRules    string             `mapstructure:"yara_rules"`
	Agent        AgentCfg           `mapstructure:"agent"`
	VirtMgr      VirtManagerCfg     `mapstructure:"virt_manager"`
	Producer     config.ProducerCfg `mapstructure:"producer"`
	Consumer     config.ConsumerCfg `mapstructure:"consumer"`
}

type DetonationResult struct {
	// The API trace results. This consists of a list of all API calls made by
	// the sample.
	APITrace []byte
	// Same as APITrace, but this is not capped to any threshold.
	// The full trace is uploaded to the object storage,
	FullAPITrace []byte
	// The buffer of large byte* for some Win32 APIs.
	APIBuffers []Win32APIBuffer
	// The logs produced by the agent running inside the VM.
	AgentLog []byte
	// The logs produced by the sandbox.
	SandboxLog []byte
	// The config used to scan dynamically the sample.
	ScanCfg config.DynFileScanCfg
	// List of of desktop screenshots captured.
	Screenshots []Screenshot
	// List of artifacts collected during detonation.
	Artifacts []Artifact
	// Environment represents the environment used to scan the file.
	Environment
	// Summary of system events.
	Events []Event
	// The process execution tree.
	ProcessTree ProcessTree
}

type Environment struct {
	// The sandbox version.
	SandboxVersion string `json:"sandbox_version"`
	// The agent version.
	AgentVersion string `json:"agent_version"`
}

type Event struct {
	// Process identifier responsible for generating the event.
	ProcessID string `json:"pid"`
	// Type of the system event.
	Type EventType `json:"type"`
	// Path of the system event. For instance, when the event is of type:
	// `registry`, the path represents the registry key being used. For a
	// `network` event type, the path is the IP or domain used.
	Path string `json:"path"`
	// Th operation requested over the above `Path` field. This field means
	// different things according to the type of the system event.
	// - For file system events: can be either: create, read, write, delete, rename, ..
	// - For registry events: can be either: create, rename, set, delete.
	// - For network events: this represents the protocol of the communication, can
	// be either HTTP, HTTPS, FTP, FTP
	Operation string `json:"op"`
}

type EventType string

type Process struct {
	// Process image's path.
	ImagePath string `json:"path"`
	// Process identifier.
	PID string `json:"pid"`
	// The parent process ID.
	ParentPID string `json:"parent_pid"`
	// The relationship between this process and its parent.
	ParentLink string `json:"parent_link"`
	// The name of the process.
	ProcessName string `json:"proc_name"`
	// The file type: doc, exe, etc.
	FileType string `json:"file_type"`
	// Detection contains the family name of the malware if it is malicious,
	// or clean otherwise.
	Detection string `json:"detection"`
}

type ProcessTree []Process

type Screenshot struct {
	// The name of the filename for the screenshot. Format: <id>.jpeg.
	// IDs are growing incrementally from index 1 to N according to the time
	// they were taken.
	Name string `json:"name"`
	// The binary content of the image.
	Content []byte `json:"-"`
}

type Service struct {
	// contains filtered or unexported fields
}

type VM struct {
	// ID identify uniquely the VM.
	ID int32
	// Name of the VM.
	Name string
	// IP address of the VM.
	IP string
	// Operating system used by the guest.
	OS string
	// Server version.
	AgentVersion string
	// Snapshots list names.
	Snapshots []string
	// InUse represents the availability of the VM.
	InUse bool
	// Indicates if the VM is healthy.
	IsHealthy bool
	// Pointer to the domain object.
	Dom *libvirt.Domain
}

type VirtManagerCfg struct {
	Network      string `mapstructure:"network"`
	Address      string `mapstructure:"address"`
	Port         string `mapstructure:"port"`
	User         string `mapstructure:"user"`
	SSHKeyPath   string `mapstructure:"ssh_key_path"`
	SnapshotName string `mapstructure:"snapshot_name"`
}

type Win32API struct {
	// Timestamp of the trace.
	Timestamp int64 `json:"ts"`
	// Name of the API.
	Name string `json:"api"`
	// List of its parameters.
	Parameters []Win32APIParam `json:"params"`
	// Process Identifier responsible for generating the API.
	ProcessID string `json:"pid"`
	// Thread Identifier responsible for generating the API.
	ThreadID string `json:"tid"`
	// The name of the process that corresponds to the process ID.
	ProcessName string `json:"proc"`
	// Return value of the API.
	ReturnValue string `json:"ret"`
}

type Win32APIBuffer struct {
	// Name of the buffer.
	Name string
	// Content of the buffer.
	Content []byte
}

type Win32APIParam struct {
	// SAL annotation.
	Annotation string `json:"anno"`
	// Name of the parameter.
	Name string `json:"name"`
	// Value of the parameter. This can be either a string or a slice of bytes.
	// This field is mutually exclusive with the In and Out values.
	Value interface{} `json:"value,omitempty"`
	// Win32 API sometimes uses IN and OUT annotations, so instead of having
	// one `value`, we separate the `in` and `out`. Occasionally, a function can
	// both reads from and writes to buffer, so ValueIn and ValueOut are filled.
	// The function reads from the buffer.
	ValueIn interface{} `json:"value_in,omitempty"`
	// The function writes to the buffer.
	ValueOut interface{} `json:"value_out,omitempty"`

	// An ID is attributed to track BYTE* parameters that spans over 4KB of data.
	// If the buffer is either IN or OUT, the ID will be on `BuffID`, otherwise:
	// BuffIDIn and BufferIdOut
	BuffID    string `json:"buff_id,omitempty"`
	BuffIDIn  string `json:"buff_id_in,omitempty"`
	BuffIDOut string `json:"buff_out,omitempty"`
}