Skip to content

Commit 2bbd985

Browse files
adulauadulau
authored
Merge pull request #422 from karenyousefi/main
add apk object
2 parents be16209 + 16d8bf7 commit 2bbd985

2 files changed

Lines changed: 189 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ for a specific attribute. An optional **to_ids** boolean field to disable the ID
118118
- [objects/annotation](https://github.com/MISP/misp-objects/blob/main/objects/annotation/definition.json) - An annotation object allowing analysts to add annotations, comments, executive summary to a MISP event, objects or attributes.
119119
- [objects/anonymisation](https://github.com/MISP/misp-objects/blob/main/objects/anonymisation/definition.json) - Anonymisation object describing an anonymisation technique used to encode MISP attribute values. Reference: https://www.caida.org/tools/taxonomy/anonymization.xml.
120120
- [objects/apivoid-email-verification](https://github.com/MISP/misp-objects/blob/main/objects/apivoid-email-verification/definition.json) - Apivoid email verification API result. Reference: https://www.apivoid.com/api/email-verify/.
121+
- [objects/apk](https://github.com/MISP/misp-objects/blob/main/objects/apk/definition.json) - Apk object describing a file with meta-information.
121122
- [objects/artifact](https://github.com/MISP/misp-objects/blob/main/objects/artifact/definition.json) - The Artifact object permits capturing an array of bytes (8-bits), as a base64-encoded string, or linking to a file-like payload. From STIX 2.1 (6.1).
122123
- [objects/asn](https://github.com/MISP/misp-objects/blob/main/objects/asn/definition.json) - Autonomous system object describing an autonomous system which can include one or more network operators managing an entity (e.g. ISP) along with their routing policy, routing prefixes or alike.
123124
- [objects/attack-pattern](https://github.com/MISP/misp-objects/blob/main/objects/attack-pattern/definition.json) - Attack pattern describing a common attack pattern enumeration and classification.

‎objects/apk/definition.json‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
{
2+
"attributes": {
3+
"malware-sample": {
4+
"description": "The file itself (binary)",
5+
"misp-attribute": "malware-sample",
6+
"ui-priority": 1
7+
},
8+
"filename": {
9+
"categories": [
10+
"Payload delivery",
11+
"Artifacts dropped",
12+
"Payload installation",
13+
"External analysis"
14+
],
15+
"description": "Filename on disk",
16+
"misp-attribute": "filename",
17+
"multiple": true,
18+
"ui-priority": 1
19+
},
20+
"md5": {
21+
"description": "[Insecure] MD5 hash (128 bits)",
22+
"misp-attribute": "md5",
23+
"recommended": false,
24+
"ui-priority": 1
25+
},
26+
"sha256": {
27+
"description": "Secure Hash Algorithm 2 (256 bits)",
28+
"misp-attribute": "sha256",
29+
"ui-priority": 1
30+
},
31+
"sha1": {
32+
"description": "[Insecure] Secure Hash Algorithm 1 (160 bits)",
33+
"misp-attribute": "sha1",
34+
"recommended": false,
35+
"ui-priority": 1
36+
},
37+
"ssdeep": {
38+
"description": "Fuzzy hash using context triggered piecewise hashes (CTPH)",
39+
"misp-attribute": "ssdeep",
40+
"ui-priority": 1
41+
},
42+
"tlsh": {
43+
"description": "Fuzzy hash by Trend Micro: Locality Sensitive Hash",
44+
"misp-attribute": "tlsh",
45+
"ui-priority": 1
46+
},
47+
"sha224": {
48+
"description": "Secure Hash Algorithm 2 (224 bits)",
49+
"misp-attribute": "sha224",
50+
"recommended": false,
51+
"ui-priority": 1
52+
},
53+
"sha384": {
54+
"description": "Secure Hash Algorithm 2 (384 bits)",
55+
"misp-attribute": "sha384",
56+
"recommended": false,
57+
"ui-priority": 1
58+
},
59+
"sha512": {
60+
"description": "Secure Hash Algorithm 2 (512 bits)",
61+
"misp-attribute": "sha512",
62+
"ui-priority": 1
63+
},
64+
"size-in-bytes": {
65+
"description": "Size of the file, in bytes",
66+
"disable_correlation": true,
67+
"misp-attribute": "size-in-bytes",
68+
"ui-priority": 1
69+
},
70+
"state": {
71+
"description": "State of the file",
72+
"disable_correlation": true,
73+
"misp-attribute": "text",
74+
"multiple": true,
75+
"ui-priority": 1,
76+
"values_list": [
77+
"Malicious",
78+
"Harmless",
79+
"Signed",
80+
"Revoked",
81+
"Expired",
82+
"Trusted"
83+
]
84+
},
85+
"package-name": {
86+
"description": "The package name of an Android app",
87+
"misp-attribute": "text",
88+
"recommended": true,
89+
"ui-priority": 1
90+
},
91+
"sha3-224": {
92+
"description": "Secure Hash Algorithm 3 (224 bits)",
93+
"misp-attribute": "sha3-224",
94+
"recommended": false,
95+
"ui-priority": 0
96+
},
97+
"sha3-256": {
98+
"description": "Secure Hash Algorithm 3 (256 bits)",
99+
"misp-attribute": "sha3-256",
100+
"recommended": false,
101+
"ui-priority": 0
102+
},
103+
"sha3-384": {
104+
"description": "Secure Hash Algorithm 3 (384 bits)",
105+
"misp-attribute": "sha3-384",
106+
"recommended": false,
107+
"ui-priority": 0
108+
},
109+
"sha3-512": {
110+
"description": "Secure Hash Algorithm 3 (512 bits)",
111+
"misp-attribute": "sha3-512",
112+
"recommended": false,
113+
"ui-priority": 0
114+
},
115+
"sha512/224": {
116+
"description": "Secure Hash Algorithm 2 (224 bits)",
117+
"misp-attribute": "sha512/224",
118+
"recommended": false,
119+
"ui-priority": 0
120+
},
121+
"sha512/256": {
122+
"description": "Secure Hash Algorithm 2 (256 bits)",
123+
"misp-attribute": "sha512/256",
124+
"recommended": false,
125+
"ui-priority": 0
126+
},
127+
"mimetype": {
128+
"description": "Mime type",
129+
"disable_correlation": true,
130+
"misp-attribute": "mime-type",
131+
"ui-priority": 0
132+
},
133+
"url": {
134+
"categories": [
135+
"Payload delivery"
136+
],
137+
"description": "Malware delivery url",
138+
"misp-attribute": "url",
139+
"multiple": true,
140+
"ui-priority": 1
141+
},
142+
"vhash": {
143+
"description": "vhash by VirusTotal",
144+
"misp-attribute": "vhash",
145+
"ui-priority": 0
146+
},
147+
"access-time": {
148+
"description": "The last time the file was accessed",
149+
"misp-attribute": "datetime",
150+
"ui-priority": 0
151+
},
152+
"creation-time": {
153+
"description": "Creation time of the file",
154+
"misp-attribute": "datetime",
155+
"ui-priority": 0
156+
},
157+
"modification-time": {
158+
"description": "Last time the file was modified",
159+
"misp-attribute": "datetime",
160+
"ui-priority": 0
161+
}
162+
},
163+
"description": "Apk object describing a file with meta-information",
164+
"meta-category": "file",
165+
"name": "apk",
166+
"requiredOneOf": [
167+
"filename",
168+
"size-in-bytes",
169+
"ssdeep",
170+
"md5",
171+
"sha1",
172+
"sha224",
173+
"sha256",
174+
"sha384",
175+
"sha512",
176+
"sha512/224",
177+
"sha512/256",
178+
"sha3-224",
179+
"sha3-256",
180+
"sha3-384",
181+
"sha3-512",
182+
"tlsh",
183+
"malware-sample",
184+
"url"
185+
],
186+
"uuid": "501bf5cf-28e0-4a5a-8056-e811c6447cfa",
187+
"version": 2
188+
}

0 commit comments

Comments
 (0)