detect-it-easy analyzer, closes #1590

api_app/analyzers_manager/file_analyzers/detectiteasy.py

@@ -0,0 +1,33 @@
+import logging
+
+from api_app.analyzers_manager.classes import DockerBasedAnalyzer, FileAnalyzer
+
+logger = logging.getLogger(__name__)
+
+
+class DetectItEasy(FileAnalyzer, DockerBasedAnalyzer):
+    name: str = "executable_analyzer"
+    url: str = "http://malware_tools_analyzers:4002/die"
+    # http request polling max number of tries
+    max_tries: int = 10
+    # interval between http request polling (in secs)
+    poll_distance: int = 3
+
+    def update(self):
+        pass
+
+    def run(self):
+        fname = str(self.filename).replace("/", "_").replace(" ", "_")
+        # get the file to send
+        binary = self.read_file_bytes()
+        args = [f"@{fname}", "--json"]
+        req_data = {
+            "args": args,
+        }
+        req_files = {fname: binary}
+        logger.info(f"Running {self.analyzer_name} with args: {args}")
+        report = self._docker_run(req_data, req_files, analyzer_name=self.analyzer_name)
+        if not report:
+            self.report.errors.append("DIE does not support the file")
+            return {}
+        return report

integrations/malware_tools_analyzers/Dockerfile

@@ -97,6 +97,12 @@ RUN python3 -m venv venv \
     && mkdir -p /tmp/thug/logs \
     && chown -R ${USER}:${USER} /tmp/thug/logs
 
+WORKDIR ${PROJECT_PATH}/die
+RUN apt-get install --no-install-recommends -y wget tar libglib2.0-0 && \
+    wget -q https://github.com/horsicq/DIE-engine/releases/download/3.01/die_lin64_portable_3.01.tar.gz && \
+    tar -xzf die_lin64_portable_3.01.tar.gz
+
+
 # prepare fangfrisch installation
 COPY crontab /etc/cron.d/crontab
 RUN mkdir -m 0770 -p /var/lib/fangfrisch \

integrations/malware_tools_analyzers/app.py

@@ -175,6 +175,12 @@ def intercept_thug_result(context, future: Future) -> None:
     command_name="/opt/deploy/qiling/venv/bin/python3 /opt/deploy/qiling/analyze.py",
 )
 
+# diec is the command for Detect It Easy
+shell2http.register_command(
+    endpoint="die",
+    command_name="/opt/deploy/die/die_lin64_portable/base/diec",
+)
+
 # with this, we can make http calls to the endpoint: /thug
 shell2http.register_command(
     endpoint="thug",

integrations/malware_tools_analyzers/entrypoint.sh

@@ -11,6 +11,11 @@ freshclam # download db for first time
 freshclam -d & # run updater in bg
 echo "running clamd"
 clamd --debug & # run daemon in bg
+
+# diec analyzer variable
+export LD_LIBRARY_PATH="/opt/deploy/die/die_lin64_portabl/base:$LD_LIBRARY_PATH"
+
+
 # change user
 su malware_tools_analyzers-user -s /bin/bash
 echo "running fangfrisch"