{"id":26654181,"url":"https://github.com/malice-plugins/fileinfo","last_synced_at":"2025-07-20T09:10:56.186Z","repository":{"id":85384123,"uuid":"48957075","full_name":"malice-plugins/fileinfo","owner":"malice-plugins","description":"Malice File Info Plugin (libmagic, exiftool, TRiD and ssdeep)","archived":false,"fork":false,"pushed_at":"2024-02-11T19:52:28.000Z","size":3606,"stargazers_count":30,"open_issues_count":2,"forks_count":12,"subscribers_count":6,"default_branch":"master","last_synced_at":"2025-04-11T08:02:46.543Z","etag":null,"topics":["docker","exiftool","file-info","malice","malware","mime-types","plugin","ssdeep","trid"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/malice-plugins.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-01-03T18:56:45.000Z","updated_at":"2025-03-24T02:40:51.000Z","dependencies_parsed_at":"2024-02-11T21:12:23.926Z","dependency_job_id":null,"html_url":"https://github.com/malice-plugins/fileinfo","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/malice-plugins/fileinfo","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Ffileinfo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Ffileinfo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Ffileinfo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Ffileinfo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/malice-plugins","download_url":"https://codeload.github.com/malice-plugins/fileinfo/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/malice-plugins%2Ffileinfo/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266094047,"owners_count":23875562,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","exiftool","file-info","malice","malware","mime-types","plugin","ssdeep","trid"],"created_at":"2025-03-25T04:57:40.523Z","updated_at":"2025-07-20T09:10:56.132Z","avatar_url":"https://github.com/malice-plugins.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# fileinfo\n\n[![Circle CI](https://circleci.com/gh/malice-plugins/fileinfo.png?style=shield)](https://circleci.com/gh/malice-plugins/fileinfo) [![License](http://img.shields.io/:license-mit-blue.svg)](http://doge.mit-license.org) [![Docker Stars](https://img.shields.io/docker/stars/malice/fileinfo.svg)](https://hub.docker.com/r/malice/fileinfo/) [![Docker Pulls](https://img.shields.io/docker/pulls/malice/fileinfo.svg)](https://hub.docker.com/r/malice/fileinfo/) [![Docker Image](https://img.shields.io/badge/docker%20image-122MB-blue.svg)](https://hub.docker.com/r/malice/fileinfo/)\n\nMalice File Info Plugin ([exiftool](https://www.sno.phy.queensu.ca/~phil/exiftool/), [TRiD](http://mark0.net/soft-trid-e.html) and [ssdeep](https://github.com/ssdeep-project/ssdeep))\n\n\u003e This repository contains a **Dockerfile** of the FileInfo malice plugin **malice/fileinfo**.\n\n---\n\n### Dependencies\n\n- [ubuntu:bionic (_84.1 MB_\\)](https://hub.docker.com/_/ubuntu/)\n\n## Installation\n\n1. Install [Docker](https://www.docker.io/).\n2. Download [trusted build](https://hub.docker.com/r/malice/fileinfo/) from public [Docker Registry](https://index.docker.io/): `docker pull malice/fileinfo`\n\n## Usage\n\n```bash\n$ docker run -v /path/to/malware:/malware malice/fileinfo FILE\n\nUsage: fileinfo [OPTIONS] COMMAND [arg...]\n\nMalice File Info Plugin - ssdeep/exiftool/TRiD\n\nVersion: , BuildTime: 20180902\n\nAuthor:\n  blacktop - \u003chttps://github.com/blacktop\u003e\n\nOptions:\n  --verbose, -V          verbose output\n  --table, -t            output as Markdown table\n  --mime, -m             output only mimetype\n  --callback, -c         POST results to Malice webhook [$MALICE_ENDPOINT]\n  --proxy, -x            proxy settings for Malice webhook endpoint [$MALICE_PROXY]\n  --elasticsearch value  elasticsearch url for Malice to store results [$MALICE_ELASTICSEARCH_URL]\n  --timeout value        malice plugin timeout (in seconds) (default: 10) [$MALICE_TIMEOUT]\n  --help, -h             show help\n  --version, -v          print the version\n\nCommands:\n  web   Create a File Info web service\n  help  Shows a list of commands or help for one command\n\nRun 'fileinfo COMMAND --help' for more information on a command.\n```\n\n## Sample Output\n\n### [JSON](https://github.com/malice-plugins/fileinfo/blob/master/docs/results.json)\n\n```json\n{\n  \"magic\": {\n    \"mime\": \"application/x-executable\",\n    \"description\": \"ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.26, BuildID[sha1]=8ffd894e500a9f125b32fa8a3f700f0f710961de, stripped\"\n  },\n  \"ssdeep\": \"768:C7tsNKQhyl96U9eJqaZ2e5ofMolkcksNmisf4BB5iqboecL027:DkXe1UHfM4N3sfezcL0\",\n  \"trid\": [\n    \"50.1% (.) ELF Executable and Linkable format (Linux) (4025/14)\",\n    \"49.8% (.O) ELF Executable and Linkable format (generic) (4000/1)\"\n  ],\n  \"exiftool\": {\n    \"CPUArchitecture\": \"64 bit\",\n    \"CPUByteOrder\": \"Little endian\",\n    \"CPUType\": \"AMD x86-64\",\n    \"ExifToolVersionNumber\": \"10.25\",\n    \"FileSize\": \"51 kB\",\n    \"FileType\": \"ELF executable\",\n    \"FileTypeExtension\": \"\",\n    \"MIMEType\": \"application/octet-stream\",\n    \"ObjectFileType\": \"Executable file\"\n  }\n}\n```\n\n### [Markdown](https://github.com/malice-plugins/fileinfo/blob/master/docs/SAMPLE.md)\n\n#### Magic\n\n| Field       | Value                                             |\n| ----------- | ------------------------------------------------- |\n| Mime        | application/x-dosexec                             |\n| Description | PE32 executable (GUI) Intel 80386, for MS Windows |\n\n#### SSDeep\n\n- `768:15jQ4nVHQaeO379u4XckKVCsknBN9A4hUnDxDiNZ957ZpK0IUUiM95Zdz:15jQ4nVHQaeO9uwckKuBN9A4UnDxcbFi`\n\n#### TRiD\n\n- 30.4% (.EXE) Win32 Executable MS Visual C\u0026#43;\u0026#43; (generic) (31206/45/13)\n- 26.9% (.EXE) Win64 Executable (generic) (27625/18/4)\n- 25.9% (.EXE) Win32 EXE Yoda\u0026#39;s Crypter (26569/9/4)\n- 6.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)\n- 4.3% (.EXE) Win32 Executable (generic) (4508/7/1)\n\n#### Exiftool\n\n| Field                 | Value                 |\n| --------------------- | --------------------- |\n| CharacterSet          | Unicode               |\n| CodeSize              | 20480                 |\n| Comments              |                       |\n| CompanyName           | Microsoft Corporation |\n| EntryPoint            | 0x5a46                |\n| ExifToolVersionNumber | 11.06                 |\n\n...`SNIP`...\n\n---\n\n## Documentation\n\n- [To write results to ElasticSearch](https://github.com/malice-plugins/fileinfo/blob/master/docs/elasticsearch.md)\n- [To create a File Info micro-service](https://github.com/malice-plugins/fileinfo/blob/master/docs/web.md)\n- [To post results to a webhook](https://github.com/malice-plugins/fileinfo/blob/master/docs/callback.md)\n\n## Issues\n\nFind a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to [file an issue](https://github.com/malice-plugins/fileinfo/issues/new)\n\n## CHANGELOG\n\nSee [`CHANGELOG.md`](https://github.com/malice-plugins/fileinfo/blob/master/CHANGELOG.md)\n\n## Contributing\n\n[See all contributors on GitHub](https://github.com/malice-plugins/fileinfo/graphs/contributors).\n\nPlease update the [CHANGELOG.md](https://github.com/malice-plugins/fileinfo/blob/master/CHANGELOG.md) and submit a [Pull Request on GitHub](https://help.github.com/articles/using-pull-requests/).\n\n## License\n\nMIT Copyright (c) 2016-2018 **blacktop**\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmalice-plugins%2Ffileinfo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmalice-plugins%2Ffileinfo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmalice-plugins%2Ffileinfo/lists"}