VirusBattle SDK v0.4

#Status: VirusBattle is operational

The VirusBattle SDK (vbSDK) provides access UL Lafayette's VirusBattle Automated Malware Analysis webservice. These are python scripts providing, both, command-line and python package, access to VirusBattle. Furthermore, VirusBattle uses a RESTful interface and thus can be accessed with any programming language.

This wiki documents the command-line access. Documentation of the python package access and RESTful interface will be developed later (on demand).

SERVICES PROVIDED

VirusBattle provides the following automated malware analysis services.

• Unpacking: Unpack PE-32 files for a large variety of unpackers using VM Introspection- monitoring execution below ring 0.
• Reverse Engineering: Calculate abstract semantics- BinJuice of basic blocks in disassembly, generate Callgraph Graphs, APIFlow Graphs and extract strings.
• Semantic Matching: Make code similarity queries at both procedure and binary levels of granularity.

OVERVIEW OF OPERATIONS

INDEX

• GETTING STARTED
  • Installation, Setup, Registration
  • Quick Start Guide for the Restless
• USE CASES
  • Reverse Engineering
  • Malware Intelligence
  • AV Signature Generation
• USAGE INSTRUCTIONS
  • Upload Files
  • Download Results
  • Query Relation between Upload and Download
  • Search Similar Binaries
  • Search Similar Procedures
• DATA MODEL
  • Objects and Relations
  • Processing Steps
  • File Identifier and Formats
• PERFORMANCE
  • Scalability
  • Usability
• COMMAND REFERENCE
  • vbClient.py Command Line
• OTHER
  • Legalese
  • Version History
  • Credits for Development
• HELP
  • Troubleshooting installation issues