potash

Documentation

Index

• func CleanHash(hash string) string
• func Generate(csvPath string, gobPath string, force bool) error
• func LoadGOB(gobPath string) (*vptree.VPTree, error)
• func RunInteractive(gobPath string, radius uint16, outFormat string) error
• func RunOnce(gobPath string, hashInput string, radius uint16, outFormat string) error
• type Malware
  • func (m Malware) Distance(tItem vptree.TreeItem) float64
  • func (m *Malware) GobDecode(data []byte) error
  • func (m Malware) GobEncode() ([]byte, error)
  • func (m Malware) Marshal(kind string) ([]byte, error)
  • func (m Malware) String() string

Functions

func CleanHash

func CleanHash(hash string) string

CleanHash removes the first two characters if the string starts with T and removes the newline character

func Generate

func Generate(csvPath string, gobPath string, force bool) error

Generate gets a csv path and spits out a tree gob file. force is used to overwrite the existing file

func LoadGOB

func LoadGOB(gobPath string) (*vptree.VPTree, error)

LoadGOB loads a tree from a gob file

func RunInteractive

func RunInteractive(gobPath string, radius uint16, outFormat string) error

func RunOnce

func RunOnce(gobPath string, hashInput string, radius uint16, outFormat string) error

RunOnce reads the GOB path for a trie or creates a new one

Types

type Malware

type Malware struct {
	tlsh.TLSH     `gob:"-"` // this is a custom type, so we need to ignore it
	FirstSeen     string
	SHA256        string
	MD5           string
	SHA1          string
	Reporter      string
	FileName      string
	FileTypeGuess string
	MIMEType      string
	Signature     string
	ClamAV        string
	VTPercent     string
	ImpHash       string
	SSDeep        string
	TLSHRaw       string
	DistanceValue float64 // This is purely used to fill out the table/JSON when printing a Malware sample against a TLSH
}

Malware is the representation of each sample as per the abuse.ch CSV file

func (Malware) Distance

func (m Malware) Distance(tItem vptree.TreeItem) float64

Distance is a required function for Malware struct to make it a vptree interface

func (*Malware) GobDecode

func (m *Malware) GobDecode(data []byte) error

GobDecode provides a standard GOB decoding

func (Malware) GobEncode

func (m Malware) GobEncode() ([]byte, error)

GobEncode provides a standard GOB encoding TODO: embed the default gob encoding and ignore the TLSH field

func (Malware) Marshal

func (m Malware) Marshal(kind string) ([]byte, error)

Marshal provides a way to show a Malware sample in different formats

func (Malware) String

func (m Malware) String() string