{"id":25029046,"url":"https://github.com/danzek/nlhbi-malware-extractor","last_synced_at":"2025-04-13T16:09:50.666Z","repository":{"id":24869696,"uuid":"28285380","full_name":"danzek/nlhbi-malware-extractor","owner":"danzek","description":"Natural Language Host-Based Indicators Malware Extraction Utility","archived":false,"fork":false,"pushed_at":"2018-01-19T21:38:52.000Z","size":73,"stargazers_count":0,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-13T16:09:45.595Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/danzek.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-12-21T01:58:45.000Z","updated_at":"2024-08-12T19:15:39.000Z","dependencies_parsed_at":"2022-08-23T09:10:57.595Z","dependency_job_id":null,"html_url":"https://github.com/danzek/nlhbi-malware-extractor","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danzek%2Fnlhbi-malware-extractor","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danzek%2Fnlhbi-malware-extractor/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danzek%2Fnlhbi-malware-extractor/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/danzek%2Fnlhbi-malware-extractor/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/danzek","download_url":"https://codeload.github.com/danzek/nlhbi-malware-extractor/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248741204,"owners_count":21154255,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-02-05T20:57:50.123Z","updated_at":"2025-04-13T16:09:50.642Z","avatar_url":"https://github.com/danzek.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# nlhbi-malware-extractor [![No Maintenance Intended](http://unmaintained.tech/badge.svg)](http://unmaintained.tech/)\n\n## Natural Language Host-Based Indicators Malware Extraction Utility\n\nThe `malware.py` module creates a `MalwareSample` object given a path to a PE32 binary executable file that has extracted section names, imported and exported symbols, filenames, urls, and strings (minus strings containing anything already extracted) from the binary file as fields/properties.\n\nThe `getNLindicators.py` module creates a list of `MalwareSample` objects and feeds this list (one object at a time) to the `process_malware_sample()` function.\n\nCurrently that processing function only has one additional call\u0026mdash;that to `extract_nl_text()`. `extract_nl_text()` iterates through a `MalwareSample` object's `strings` property/field and tokenizes strings containing natural language text, using WordNet to identify whether tokens in the string are valid English-language words or not. A list of tokenized strings is returned (which is a list of lists). The intent is for these tokenized strings containing natural language text to be used as host-based indicators for malware, perhaps after additional natural language processing or computational linguistic analysis is performed.\n\n## Course\n\nThis code was written for [Dr. Sam Liles'](http://selil.com) CNIT 58100 Cyber Forensics of Malware course.\n\n## License\n\n[GNU General Public License v2](https://github.com/danzek/nlhbi-malware-extractor/blob/master/LICENSE), as this is most compatible with libraries used for this project (see below).\n\nCopyright (c) 2014 [Dan O'Day](http://4n68r.com), \u003cdoday@purdue.edu\u003e. All rights reserved.\n\n## Libraries Used\n\n - pefile (Portable Executable reader module)\n - PEframe\n - NLTK\n - WordNet (English lexical database)\n\n**PEframe Copyright / License Notice**\n\nPEframe is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.\n\nPEframe is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License along with PEframe. If not, see \u003chttp://www.gnu.org/licenses/\u003e.\n\n**pefile Copyright Information**\n\nCopyright (c) 2004-2013 Ero Carrera \u003cero@dkbza.org\u003e. All rights reserved.\n\nRedistribution and use in source and binary forms, with or without\nmodification, are permitted provided that the following conditions are met:\n\n1. Redistributions of source code must retain the above copyright notice, this\nlist of conditions and the following disclaimer.\n\n2. Redistributions in binary form must reproduce the above copyright notice,\nthis list of conditions and the following disclaimer in the documentation\nand/or other materials provided with the distribution.\n\n3. The name of the author may not be used to endorse or promote products\nderived from this software without specific prior written permission.\n\nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR \"AS IS\" AND ANY EXPRESS OR IMPLIED\nWARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO\nEVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,\nEXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\nOF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS\nINTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN\nCONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING\nIN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY\nOF SUCH DAMAGE.\n\n**NLTK License**\n\nCopyright (C) 2001-2014 NLTK Project\n\nLicensed under the Apache License, Version 2.0 (the 'License');\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n   http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an 'AS IS' BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\n**WordNet License**\n\nWordNet Release 3.0 This software and database is being provided to you, the LICENSEE, by Princeton University under the following license. By obtaining, using and/or copying this software and database, you agree that you have read, understood, and will comply with these terms and conditions.: Permission to use, copy, modify and distribute this software and database and its documentation for any purpose and without fee or royalty is hereby granted, provided that you agree to comply with the following copyright notice and statements, including the disclaimer, and that the same appear on ALL copies of the software, database and documentation, including modifications that you make for internal use or for distribution. WordNet 3.0 Copyright 2006 by Princeton University. All rights reserved. THIS SOFTWARE AND DATABASE IS PROVIDED \"AS IS\" AND PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY WAY OF EXAMPLE, BUT NOT LIMITATION, PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR WARRANTIES OF MERCHANT- ABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE USE OF THE LICENSED SOFTWARE, DATABASE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. The name of Princeton University or Princeton may not be used in advertising or publicity pertaining to distribution of the software and/or database. Title to copyright in this software, database and any associated documentation shall at all times remain with Princeton University and LICENSEE agrees to preserve same.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdanzek%2Fnlhbi-malware-extractor","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdanzek%2Fnlhbi-malware-extractor","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdanzek%2Fnlhbi-malware-extractor/lists"}