Merge branch 'main' of github.com:MISP/misp-modules into main

REQUIREMENTS

@@ -14,7 +14,7 @@
 -e git+https://github.com/sebdraven/pydnstrails@48c1f740025c51289f43a24863d1845ff12fd21a#egg=pydnstrails
 -e git+https://github.com/sebdraven/pyonyphe@1ce15581beebb13e841193a08a2eb6f967855fcb#egg=pyonyphe
 git+https://github.com/SteveClement/trustar-python.git
-aiohttp==3.7.4.post0
+aiohttp==3.7.4
 antlr4-python3-runtime==4.8; python_version >= '3'
 apiosintds==1.8.3
 argparse==1.4.0
@@ -28,7 +28,9 @@ bidict==0.21.2; python_version >= '3.6'
 blockchain==1.4.4
 certifi==2021.5.30
 cffi==1.14.6
-chardet==4.0.0; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'
+
+#chardet==4.0.0; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4'
+chardet
 charset-normalizer==2.0.4; python_version >= '3'
 clamd==1.0.2
 click-plugins==1.1.1
@@ -64,7 +66,7 @@ json-log-formatter==0.4.0
 jsonschema==3.2.0
 lark-parser==0.11.3
 lief==0.11.5
-lxml==4.6.4
+lxml==4.7.1
 maclookup==1.0.3
 markdownify==0.5.3
 maxminddb==2.0.3; python_version >= '3.6'
@@ -82,7 +84,7 @@ pandas==1.1.5
 passivetotal==2.5.4
 pcodedmp==1.2.6
 pdftotext==2.2.0
-pillow==8.3.1
+pillow==8.3.2
 progressbar2==3.53.1
 psutil==5.8.0; python_version >= '2.6' and python_version not in '3.0, 3.1, 3.2, 3.3'
 pycparser==2.20; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'

misp_modules/modules/expansion/hashlookup.py

@@ -5,8 +5,8 @@ from collections import defaultdict
 from pymisp import MISPEvent, MISPObject
 
 misperrors = {'error': 'Error'}
-mispattributes = {'input': ['md5', 'sha1'], 'format': 'misp_standard'}
-moduleinfo = {'version': '1', 'author': 'Alexandre Dulaunoy',
+mispattributes = {'input': ['md5', 'sha1', 'sha256'], 'format': 'misp_standard'}
+moduleinfo = {'version': '2', 'author': 'Alexandre Dulaunoy',
               'description': 'An expansion module to enrich a file hash with hashlookup.circl.lu services (NSRL and other sources)',
               'module-type': ['expansion', 'hover']}
 moduleconfig = ["custom_API"]
@@ -35,8 +35,12 @@ class HashlookupParser():
             hashlookup_object.add_attribute('source', **{'type': 'text', 'value': self.hashlookupresult['source']})
         if 'KnownMalicious' in self.hashlookupresult:
             hashlookup_object.add_attribute('KnownMalicious', **{'type': 'text', 'value': self.hashlookupresult['KnownMalicious']})
-        hashlookup_object.add_attribute('MD5', **{'type': 'md5', 'value': self.hashlookupresult['MD5']})
+        if 'MD5' in self.hashlookupresult:
+            hashlookup_object.add_attribute('MD5', **{'type': 'md5', 'value': self.hashlookupresult['MD5']})
+        # SHA-1 is the default value in hashlookup it must always be present
         hashlookup_object.add_attribute('SHA-1', **{'type': 'sha1', 'value': self.hashlookupresult['SHA-1']})
+        if 'SHA-256' in self.hashlookupresult:
+            hashlookup_object.add_attribute('SHA-256', **{'type': 'sha256', 'value': self.hashlookupresult['SHA-256']})
         if 'SSDEEP' in self.hashlookupresult:
             hashlookup_object.add_attribute('SSDEEP', **{'type': 'ssdeep', 'value': self.hashlookupresult['SSDEEP']})
         if 'TLSH' in self.hashlookupresult:
@@ -71,8 +75,10 @@ def handler(q=False):
         pass
     elif attribute.get('type') == 'sha1':
         pass
+    elif attribute.get('type') == 'sha256':
+        pass
     else:
-        misperrors['error'] = 'md5 or sha1 is missing.'
+        misperrors['error'] = 'md5 or sha1 or sha256 is missing.'
         return misperrors
     api_url = check_url(request['config']['custom_API']) if request['config'].get('custom_API') else hashlookup_url
     r = requests.get("{}/lookup/{}/{}".format(api_url, attribute.get('type'), attribute['value']))