malice-plugins / fileinfo Goto Github PK

>> docker -D run --rm -v /var/run/docker.sock:/var/run/docker.sock -v `pwd`:/malice/samples --network="host" malice/fileinfo putty.exe

...

#### Exiftool
| Field       | Value                |
|-------------|----------------------|
| error  | exit status 1        |

...

Docker version:
Client:
 Version:           18.09.0
 API version:       1.39
 Go version:        go1.10.4
 Git commit:        4d60db4
 Built:             Wed Nov  7 00:49:01 2018
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.0
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.4
  Git commit:       4d60db4
  Built:            Wed Nov  7 00:16:44 2018
  OS/Arch:          linux/amd64
  Experimental:     false

Docker info:
Containers: 6
 Running: 1
 Paused: 0
 Stopped: 5
Images: 26
Server Version: 18.09.0
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: c4446665cb9c30056f4998ed953e6d4ff22c7c39
runc version: 4fc53a81fb7c994640722ac585fa9ca548971871
init version: fec3683
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.15.0-39-generic
Operating System: Linux Mint 19
OSType: linux
Architecture: x86_64
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine

WARNING: No swap limit support

$ curl -i -X POST -H "Content-Type: multipart/form-data" -F "[email protected]" http://localhost:3993/scan
HTTP/1.1 100 Continue

HTTP/1.1 200 OK
Content-Type: application/json; charset=UTF-8
Date: Mon, 20 Aug 2018 10:20:26 GMT
Content-Length: 1380

{
   "magic":{
      "mime":"text/plain",
      "description":"**ASCII text, with very long lines, with no line terminators**"
   },
   "ssdeep":"6144:WmNxBCD65shMJmpdFvuKmZEPi4rj2/kH+/MH:WoWD0shvdhqEa4HOmIMH",
   "trid":[
      "**82.7% (.EXE) Win32 Executable Microsoft** Visual Basic 6 (82067/2/8)",
      "6.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)",
      "4.5% (.EXE) Win32 Executable (generic) (4508/7/1)",
      "2.0% (.EXE) OS/2 Executable (generic) (2029/13)",
      "2.0% (.EXE) Generic Win/DOS Executable (2002/3)"
   ],
   "exiftool":{
      "CharacterSet":"Unicode",
      "CodeSize":"307200",
      "Comments":"Scribblative",
      "CompanyName":"NCH Software",
      "EntryPoint":"0x11b8",
      "ExifToolVersionNumber":"11.06",
      "FileDescription":"Redcrested2",
      "FileFlags":"(none)",
      "FileFlagsMask":"0x0000",
      "FileOS":"Win32",
      "FileSize":"316 kB",
      "FileSubtype":"0",
      "FileType":"Win32 EXE",
      "FileTypeExtension":"exe",
      "FileVersion":"1.00",
      "FileVersionNumber":"1.0.0.0",
      "ImageVersion":"1.0",
      "InitializedDataSize":"24576",
      "InternalName":"Infraglacial2",
      "LanguageCode":"Chinese (Traditional)",
      "LinkerVersion":"6.0",
      "MIMEType":"application/octet-stream",
      "MachineType":"Intel 386 or later, and compatibles",
      "OSVersion":"4.0",
      "ObjectFileType":"Executable application",
      "OriginalFileName":"Infraglacial2.exe",
      "PEType":"PE32",
      "ProductName":"Touch",
      "ProductVersion":"1.00",
      "ProductVersionNumber":"1.0.0.0",
      "Subsystem":"Windows GUI",
      "SubsystemVersion":"4.0",
      "UninitializedDataSize":"0"
   }
}