misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/cpe.py

@@ -0,0 +1,140 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from pymisp import MISPEvent, MISPObject
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['cpe'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '2',
+    'author': 'Christian Studer',
+    'description': 'An expansion module to query the CVE search API with a cpe code to get its related vulnerabilities.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'CPE Lookup',
+    'logo': 'cve.png',
+    'requirements': [],
+    'features': 'The module takes a cpe attribute as input and queries the CVE search API to get its related vulnerabilities.  \nThe list of vulnerabilities is then parsed and returned as vulnerability objects.\n\nUsers can use their own CVE search API url by defining a value to the custom_API_URL parameter. If no custom API url is given, the default vulnerability.circl.lu api url is used.\n\nIn order to limit the amount of data returned by CVE serach, users can also the limit parameter. With the limit set, the API returns only the requested number of vulnerabilities, sorted from the highest cvss score to the lowest one.',
+    'references': ['https://vulnerability.circl.lu/api/'],
+    'input': 'CPE attribute.',
+    'output': 'The vulnerabilities related to the CPE.',
+}
+moduleconfig = ["custom_API_URL", "limit"]
+cveapi_url = 'https://cvepremium.circl.lu/api/query'
+DEFAULT_LIMIT = 10
+
+
+class VulnerabilitiesParser():
+    def __init__(self, attribute):
+        self.attribute = attribute
+        self.misp_event = MISPEvent()
+        self.misp_event.add_attribute(**attribute)
+        self.vulnerability_mapping = {
+            'id': {
+                'type': 'vulnerability',
+                'object_relation': 'id'
+            },
+            'summary': {
+                'type': 'text',
+                'object_relation': 'summary'
+            },
+            'vulnerable_configuration': {
+                'type': 'cpe',
+                'object_relation': 'vulnerable-configuration'
+            },
+            'vulnerable_configuration_cpe_2_2': {
+                'type': 'cpe',
+                'object_relation': 'vulnerable-configuration'
+            },
+            'Modified': {
+                'type': 'datetime',
+                'object_relation': 'modified'
+            },
+            'Published': {
+                'type': 'datetime',
+                'object_relation': 'published'
+            },
+            'references': {
+                'type': 'link',
+                'object_relation': 'references'
+            },
+            'cvss': {
+                'type': 'float',
+                'object_relation': 'cvss-score'
+            }
+        }
+
+    def parse_vulnerabilities(self, vulnerabilities):
+        for vulnerability in vulnerabilities:
+            vulnerability_object = MISPObject('vulnerability')
+            for feature in ('id', 'summary', 'Modified', 'Published', 'cvss'):
+                if vulnerability.get(feature):
+                    attribute = {'value': vulnerability[feature]}
+                    attribute.update(self.vulnerability_mapping[feature])
+                    vulnerability_object.add_attribute(**attribute)
+            if vulnerability.get('Published'):
+                vulnerability_object.add_attribute(**{
+                    'type': 'text',
+                    'object_relation': 'state',
+                    'value': 'Published'
+                })
+            for feature in ('references', 'vulnerable_configuration', 'vulnerable_configuration_cpe_2_2'):
+                if vulnerability.get(feature):
+                    for value in vulnerability[feature]:
+                        if isinstance(value, dict):
+                            value = value['title']
+                        attribute = {'value': value}
+                        attribute.update(self.vulnerability_mapping[feature])
+                        vulnerability_object.add_attribute(**attribute)
+            vulnerability_object.add_reference(self.attribute['uuid'], 'related-to')
+            self.misp_event.add_object(vulnerability_object)
+
+    def get_result(self):
+        event = json.loads(self.misp_event.to_json())
+        results = {key: event[key] for key in ('Attribute', 'Object')}
+        return {'results': results}
+
+
+def check_url(url):
+    return url if url.endswith('/') else f"{url}/"
+
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request['attribute']
+    if attribute.get('type') != 'cpe':
+        return {'error': 'Wrong input attribute type.'}
+    config = request['config']
+    url = check_url(config['custom_API_URL']) if config.get('custom_API_URL') else cveapi_url
+    limit = int(config['limit']) if config.get('limit') else DEFAULT_LIMIT
+    params = {
+        "retrieve": "cves",
+        "dict_filter": {
+            "vulnerable_configuration": attribute['value']
+        },
+        "limit": limit,
+        "sort": "cvss",
+        "sort_dir": "DESC"
+    }
+    response = requests.post(url, json=params)
+    if response.status_code == 200:
+        vulnerabilities = response.json()['data']
+        if not vulnerabilities:
+            return {'error': 'No related vulnerability for this CPE.'}
+    else:
+        return {'error': 'API not accessible.'}
+    parser = VulnerabilitiesParser(attribute)
+    parser.parse_vulnerabilities(vulnerabilities)
+    return parser.get_result()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/crowdsec.py

@@ -0,0 +1,235 @@
+import ipaddress
+import json
+
+import pycountry
+import requests
+from pymisp import MISPEvent, MISPObject
+
+from . import check_input_attribute, standard_error_message
+
+mispattributes = {"input": ["ip-dst", "ip-src"], "format": "misp_standard"}
+moduleinfo = {
+    "version": "2.1",
+    "author": "Shivam Sandbhor <shivam@crowdsec.net>",
+    "description": "Module to access CrowdSec CTI API.",
+    "module-type": ["hover", "expansion"],
+    "name": "CrowdSec CTI",
+    "logo": "crowdsec.png",
+    "requirements": [
+        "A CrowdSec CTI API key. Get yours by following https://docs.crowdsec.net/docs/cti_api/getting_started/#getting-an-api-key"
+    ],
+    "features": "This module enables IP lookup from CrowdSec CTI API. It provides information about the IP, such as what kind of attacks it has been participant of as seen by CrowdSec's network. It also includes enrichment by CrowdSec like background noise score, aggressivity over time etc.",
+    "references": [
+        "https://www.crowdsec.net/",
+        "https://docs.crowdsec.net/docs/cti_api/getting_started",
+        "https://app.crowdsec.net/",
+    ],
+    "input": "An IP address.",
+    "output": "IP Lookup information from CrowdSec CTI API",
+}
+moduleconfig = [
+    "api_key",
+    "add_reputation_tag",
+    "add_behavior_tag",
+    "add_classification_tag",
+    "add_mitre_technique_tag",
+    "add_cve_tag",
+]
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+    if not request.get("config"):
+        return {"error": "Missing CrowdSec Config"}
+
+    if not request["config"].get("api_key"):
+        return {"error": "Missing CrowdSec API key"}
+
+    if not request.get("attribute") or not check_input_attribute(request["attribute"]):
+        return {
+            "error": f"{standard_error_message}, which should contain at least a type, a value and an uuid."
+        }
+
+    if request["attribute"].get("type") not in mispattributes["input"]:
+        return {
+            "error": f"Wrong input type. Please choose on of the following: {', '.join(mispattributes['input'])}"
+        }
+
+    return _handler_v2(request)
+
+
+def _get_boolean_config(request_data, config: str, default_config: bool):
+    if request_data["config"].get(config) is None:
+        return default_config
+    raw_config = request_data["config"].get(config).lower()
+    # falsy values, return False
+    if raw_config in ["false", "0", "no", "off"]:
+        return False
+    # truthy values, return True
+    if raw_config in ["true", "1", "yes", "on"]:
+        return True
+    return default_config
+
+
+def _handler_v2(request_data):
+    attribute = request_data["attribute"]
+    ip = attribute["value"]
+    # Validate IP
+    try:
+        ipaddress.ip_address(ip)
+    except ValueError:
+        return {
+            "error": f"IP ({ip}) is not valid for calling CrowdSec CTI. Please provide a valid IP address."
+        }
+
+    crowdsec_cti = requests.get(
+        f"https://cti.api.crowdsec.net/v2/smoke/{ip}",
+        headers={
+            "x-api-key": request_data["config"]["api_key"],
+            "User-Agent": "crowdsec-misp/v2.1.1",
+        },
+    )
+    crowdsec_cti.raise_for_status()
+    crowdsec_cti = crowdsec_cti.json()
+
+    add_reputation_tag = _get_boolean_config(request_data, "add_reputation_tag", True)
+    add_behavior_tag = _get_boolean_config(request_data, "add_behavior_tag", True)
+    add_classification_tag = _get_boolean_config(
+        request_data, "add_classification_tag", True
+    )
+    add_mitre_technique_tag = _get_boolean_config(
+        request_data, "add_mitre_technique_tag", True
+    )
+    add_cve_tag = _get_boolean_config(request_data, "add_cve_tag", True)
+
+    misp_event = MISPEvent()
+    misp_attribute = misp_event.add_attribute(**attribute)
+    crowdsec_context_object = MISPObject("crowdsec-ip-context")
+    crowdsec_context_object.from_dict(
+        first_seen=crowdsec_cti["history"]["first_seen"],
+        last_seen=crowdsec_cti["history"]["last_seen"],
+    )
+    ip_attribute = crowdsec_context_object.add_attribute("ip", crowdsec_cti["ip"])
+    reputation = crowdsec_cti["reputation"] or "unknown"
+    crowdsec_context_object.add_attribute("reputation", reputation)
+    if add_reputation_tag:
+        tag = f'crowdsec:reputation="{reputation}"'
+        ip_attribute.add_tag(tag)
+    crowdsec_context_object.add_attribute("ip-range", crowdsec_cti["ip_range"])
+    crowdsec_context_object.add_attribute(
+        "ip-range-score", crowdsec_cti["ip_range_score"]
+    )
+    crowdsec_context_object.add_attribute(
+        "country", get_country_name_from_alpha_2(crowdsec_cti["location"]["country"])
+    )
+    crowdsec_context_object.add_attribute(
+        "country-code", crowdsec_cti["location"]["country"]
+    )
+    if crowdsec_cti["location"].get("city"):
+        crowdsec_context_object.add_attribute("city", crowdsec_cti["location"]["city"])
+    crowdsec_context_object.add_attribute(
+        "latitude", crowdsec_cti["location"]["latitude"]
+    )
+    crowdsec_context_object.add_attribute(
+        "longitude", crowdsec_cti["location"]["longitude"]
+    )
+    crowdsec_context_object.add_attribute("as-name", crowdsec_cti["as_name"])
+    crowdsec_context_object.add_attribute("as-num", crowdsec_cti["as_num"])
+    if crowdsec_cti.get("reverse_dns") is not None:
+        crowdsec_context_object.add_attribute(
+            "reverse-dns", crowdsec_cti["reverse_dns"]
+        )
+    crowdsec_context_object.add_attribute(
+        "background-noise", crowdsec_cti["background_noise_score"]
+    )
+    for behavior in crowdsec_cti["behaviors"]:
+        crowdsec_context_object.add_attribute(
+            "behaviors", behavior["label"], comment=behavior["description"]
+        )
+        if add_behavior_tag:
+            tag = f'crowdsec:behavior="{behavior["name"]}"'
+            ip_attribute.add_tag(tag)
+    for technique in crowdsec_cti["mitre_techniques"]:
+        technique_name = technique["name"]
+        mitre_url = (
+            f"https://attack.mitre.org/tactics/{technique_name}"
+            if technique_name.startswith("TA")
+            else f"https://attack.mitre.org/techniques/{technique_name}"
+        )
+        crowdsec_context_object.add_attribute(
+            "mitre-techniques",
+            technique["label"],
+            comment=f'{technique["description"]} ({mitre_url})',
+        )
+        if add_mitre_technique_tag:
+            tag = f'crowdsec:mitre-technique="{technique_name}"'
+            ip_attribute.add_tag(tag)
+
+    for cve in crowdsec_cti["cves"]:
+        cve_url = f"https://nvd.nist.gov/vuln/detail/{cve}"
+        crowdsec_context_object.add_attribute("cves", cve, comment=cve_url)
+        if add_cve_tag:
+            tag = f'crowdsec:cve="{cve}"'
+            ip_attribute.add_tag(tag)
+
+    for feature, values in crowdsec_cti["classifications"].items():
+        field = feature[:-1]
+        for value in values:
+            crowdsec_context_object.add_attribute(
+                feature, value["label"], comment=value["description"]
+            )
+            if add_classification_tag:
+                tag = f'crowdsec:{field}="{value["name"]}"'
+                ip_attribute.add_tag(tag)
+    crowdsec_context_object.add_attribute(
+        "attack-details",
+        ", ".join(
+            f"{scenario['name']} - {scenario['label']} ({scenario['description']})"
+            for scenario in crowdsec_cti["attack_details"]
+        ),
+    )
+    crowdsec_context_object.add_attribute(
+        "target-countries",
+        ", ".join(
+            map(get_country_name_from_alpha_2, crowdsec_cti["target_countries"].keys())
+        ),
+    )
+    crowdsec_context_object.add_attribute(
+        "trust", crowdsec_cti["scores"]["overall"]["trust"]
+    )
+    scores = []
+    for time_period, indicators in crowdsec_cti["scores"].items():
+        tp = " ".join(map(str.capitalize, time_period.split("_")))
+        indicator = (
+            f"{indicator_type.capitalize()}: {indicator_value}"
+            for indicator_type, indicator_value in indicators.items()
+        )
+        scores.append(f"{tp}: {' - '.join(indicator)}")
+    crowdsec_context_object.add_attribute("scores", ", ".join(scores))
+    crowdsec_context_object.add_reference(misp_attribute.uuid, "related-to")
+    misp_event.add_object(crowdsec_context_object)
+
+    event = json.loads(misp_event.to_json())
+    results = {
+        key: event[key]
+        for key in ("Attribute", "Object")
+        if (key in event and event[key])
+    }
+    return {"results": results}
+
+
+def get_country_name_from_alpha_2(alpha_2):
+    country_info = pycountry.countries.get(alpha_2=alpha_2)
+    return country_info.name if country_info else None
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/crowdstrike_falcon.py

@@ -0,0 +1,148 @@
+import json
+from . import check_input_attribute, standard_error_message
+from falconpy import Intel
+from pymisp import MISPAttribute, MISPEvent
+
+moduleinfo = {
+    'version': '0.2',
+    'author': 'Christophe Vandeplas',
+    'description': 'Module to query CrowdStrike Falcon.',
+    'module-type': ['expansion', 'hover'],
+    'name': 'CrowdStrike Falcon',
+    'logo': 'crowdstrike.png',
+    'requirements': ['A CrowdStrike API access (API id & key)'],
+    'features': 'This module takes a MISP attribute as input to query a CrowdStrike Falcon API. The API returns then the result of the query with some types we map into compatible types we add as MISP attributes.\n\nPlease note that composite attributes composed by at least one of the input types mentionned below (domains, IPs, hostnames) are also supported.',
+    'references': ['https://www.crowdstrike.com/products/crowdstrike-falcon-faq/'],
+    'input': 'A MISP attribute included in the following list:\n- domain\n- email-attachment\n- email-dst\n- email-reply-to\n- email-src\n- email-subject\n- filename\n- hostname\n- ip-src\n- ip-dst\n- md5\n- mutex\n- regkey\n- sha1\n- sha256\n- uri\n- url\n- user-agent\n- whois-registrant-email\n- x509-fingerprint-md5',
+    'output': 'MISP attributes mapped after the CrowdStrike API has been queried, included in the following list:\n- hostname\n- email-src\n- email-subject\n- filename\n- md5\n- sha1\n- sha256\n- ip-dst\n- ip-dst\n- mutex\n- regkey\n- url\n- user-agent\n- x509-fingerprint-md5',
+}
+moduleconfig = ['api_id', 'apikey']
+misperrors = {'error': 'Error'}
+misp_type_in = ['domain', 'email-attachment', 'email-dst', 'email-reply-to', 'email-src', 'email-subject',
+                 'filename', 'hostname', 'ip', 'ip-src', 'ip-dst', 'md5', 'mutex', 'regkey', 'sha1', 'sha256', 'uri', 'url',
+                 'user-agent', 'whois-registrant-email', 'x509-fingerprint-md5']
+mapping_out = {  # mapping between the MISP attributes type and the compatible CrowdStrike indicator types.
+    'domain': {'type': 'hostname', 'to_ids': True},
+    'email_address': {'type': 'email-src', 'to_ids': True},
+    'email_subject': {'type': 'email-subject', 'to_ids': True},
+    'file_name': {'type': 'filename', 'to_ids': True},
+    'hash_md5': {'type': 'md5', 'to_ids': True},
+    'hash_sha1': {'type': 'sha1', 'to_ids': True},
+    'hash_sha256': {'type': 'sha256', 'to_ids': True},
+    'ip_address': {'type': 'ip-dst', 'to_ids': True},
+    'ip_address_block': {'type': 'ip-dst', 'to_ids': True},
+    'mutex_name': {'type': 'mutex', 'to_ids': True},
+    'registry': {'type': 'regkey', 'to_ids': True},
+    'url': {'type': 'url', 'to_ids': True},
+    'user_agent': {'type': 'user-agent', 'to_ids': True},
+    'x509_serial': {'type': 'x509-fingerprint-md5', 'to_ids': True},
+
+    'actors': {'type': 'threat-actor', 'category': 'Attribution'},
+    'malware_families': {'type': 'text', 'category': 'Attribution'}
+}
+misp_type_out = [item['type'] for item in mapping_out.values()]
+mispattributes = {'input': misp_type_in, 'format': 'misp_standard'}
+
+def handler(q=False):
+    if q is False:
+        return False
+    request = json.loads(q)
+    #validate CrowdStrike params
+    if (request.get('config')):
+        if (request['config'].get('apikey') is None):
+            misperrors['error'] = 'CrowdStrike apikey is missing'
+            return misperrors
+        if (request['config'].get('api_id') is None):
+            misperrors['error'] = 'CrowdStrike api_id is missing'
+            return misperrors
+
+    #validate attribute
+    if not request.get('attribute') or not check_input_attribute(request['attribute']):
+        return {'error': f'{standard_error_message}, which should contain at least a type, a value and an uuid.'}
+    attribute = request.get('attribute')
+    if not any(input_type == attribute.get('type') for input_type in misp_type_in):
+        return {'error': 'Unsupported attribute type.'}
+
+    client = CSIntelAPI(request['config']['api_id'], request['config']['apikey'])
+
+    attribute = MISPAttribute()
+    attribute.from_dict(**request.get('attribute') )
+    r = {"results": []}
+    valid_type = False
+
+    try:
+        for k in misp_type_in:
+            if attribute.type == k:
+                # map the MISP type to the CrowdStrike type
+                r['results'].append(lookup_indicator(client, attribute))
+                valid_type = True
+    except Exception as e:
+        return {'error': f"{e}"}
+
+    if not valid_type:
+        misperrors['error'] = "Unsupported attributes type"
+        return misperrors
+    return {'results': r.get('results').pop()}
+
+
+def lookup_indicator(client, ref_attribute):
+    result = client.search_indicator(ref_attribute.value)
+    misp_event = MISPEvent()
+    misp_event.add_attribute(**ref_attribute)
+
+    for item in result.get('resources', []):
+        for relation in item.get('relations'):
+            if mapping_out.get(relation.get('type')):
+                r = mapping_out[relation.get('type')].copy()
+                r['value'] = relation.get('indicator')
+                attribute = MISPAttribute()
+                attribute.from_dict(**r)
+                misp_event.add_attribute(**attribute)
+        for actor in item.get('actors'):
+            r = mapping_out.get('actors').copy()
+            r['value'] = actor
+            attribute = MISPAttribute()
+            attribute.from_dict(**r)
+            misp_event.add_attribute(**attribute)
+        if item.get('malware_families'):
+            r = mapping_out.get('malware_families').copy()
+            r['value'] = f"malware_families: {' | '.join(item.get('malware_families'))}"
+            attribute = MISPAttribute()
+            attribute.from_dict(**r)
+            misp_event.add_attribute(**attribute)
+
+    event = json.loads(misp_event.to_json())
+    return {'Object': event.get('Object', []), 'Attribute': event.get('Attribute', [])}
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo
+
+
+class CSIntelAPI():
+    def __init__(self, custid=None, custkey=None):
+        # customer id and key should be passed when obj is created
+        self.falcon = Intel(client_id=custid, client_secret=custkey)
+
+    def search_indicator(self, query):
+        r = self.falcon.query_indicator_entities(q=query)
+        # 400 - bad request
+        if r.get('status_code') == 400:
+            raise Exception('HTTP Error 400 - Bad request.')
+
+        # 404 - oh shit
+        if r.get('status_code') == 404:
+            raise Exception('HTTP Error 404 - awww snap.')
+
+        # catch all?
+        if r.get('status_code') != 200:
+            raise Exception('HTTP Error: ' + str(r.get('status_code')))
+
+        if len(r.get('body').get('errors')):
+            raise Exception('API Error: ' + ' | '.join(r.get('body').get('errors')))
+
+        return r.get('body', {})

misp_modules/modules/expansion/cuckoo_submit.py

@@ -0,0 +1,161 @@
+import base64
+import io
+import json
+import logging
+import requests
+import sys
+import urllib.parse
+import zipfile
+
+from requests.exceptions import RequestException
+
+log = logging.getLogger("cuckoo_submit")
+log.setLevel(logging.DEBUG)
+sh = logging.StreamHandler(sys.stdout)
+sh.setLevel(logging.DEBUG)
+fmt = logging.Formatter(
+    "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
+)
+sh.setFormatter(fmt)
+log.addHandler(sh)
+
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Evert Kors',
+    'description': 'Submit files and URLs to Cuckoo Sandbox',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Cuckoo Submit',
+    'logo': 'cuckoo.png',
+    'requirements': ['Access to a Cuckoo Sandbox API and an API key if the API requires it. (api_url and api_key)'],
+    'features': 'The module takes a malware-sample, attachment, url or domain and submits it to Cuckoo Sandbox.\n The returned task id can be used to retrieve results when the analysis completed.',
+    'references': ['https://cuckoosandbox.org/', 'https://cuckoo.sh/docs/'],
+    'input': 'A malware-sample or attachment for files. A url or domain for URLs.',
+    'output': "A text field containing 'Cuckoo task id: <id>'",
+}
+misperrors = {"error": "Error"}
+moduleconfig = ["api_url", "api_key"]
+mispattributes = {
+    "input": ["attachment", "malware-sample", "url", "domain"],
+    "output": ["text"]
+}
+
+
+class APIKeyError(RequestException):
+    """Raised if the Cuckoo API returns a 401. This means no or an invalid
+    bearer token was supplied."""
+    pass
+
+
+class CuckooAPI(object):
+
+    def __init__(self, api_url, api_key=""):
+        self.api_key = api_key
+        if not api_url.startswith("http"):
+            api_url = "https://{}".format(api_url)
+
+        self.api_url = api_url
+
+    def _post_api(self, endpoint, files=None, data={}):
+        data.update({
+            "owner": "MISP"
+        })
+
+        try:
+            response = requests.post(
+                urllib.parse.urljoin(self.api_url, endpoint),
+                files=files, data=data,
+                headers={"Authorization": "Bearer {}".format(self.api_key)}
+            )
+        except RequestException as e:
+            log.error("Failed to submit sample to Cuckoo Sandbox. %s", e)
+            return None
+
+        if response.status_code == 401:
+            raise APIKeyError("Invalid or no Cuckoo Sandbox API key provided")
+
+        if response.status_code != 200:
+            log.error("Invalid Cuckoo API response")
+            return None
+
+        return response.json()
+
+    def create_task(self, filename, fp):
+        response = self._post_api(
+            "/tasks/create/file", files={"file": (filename, fp)}
+        )
+        if not response:
+            return False
+
+        return response["task_id"]
+
+    def create_url(self, url):
+        response = self._post_api(
+            "/tasks/create/url", data={"url": url}
+        )
+        if not response:
+            return False
+
+        return response["task_id"]
+
+
+def handler(q=False):
+    if q is False:
+        return False
+
+    request = json.loads(q)
+
+    # See if the API URL was provided. The API key is optional, as it can
+    # be disabled in the Cuckoo API settings.
+    api_url = request["config"].get("api_url")
+    api_key = request["config"].get("api_key", "")
+    if not api_url:
+        misperrors["error"] = "No Cuckoo API URL provided"
+        return misperrors
+
+    url = request.get("url") or request.get("domain")
+    data = request.get("data")
+    filename = None
+    if data:
+        data = base64.b64decode(data)
+
+        if "malware-sample" in request:
+            filename = request.get("malware-sample").split("|", 1)[0]
+            with zipfile.ZipFile(io.BytesIO(data)) as zipf:
+                data = zipf.read(zipf.namelist()[0], pwd=b"infected")
+
+        elif "attachment" in request:
+            filename = request.get("attachment")
+
+    cuckoo_api = CuckooAPI(api_url=api_url, api_key=api_key)
+    task_id = None
+    try:
+        if url:
+            log.debug("Submitting URL to Cuckoo Sandbox %s", api_url)
+            task_id = cuckoo_api.create_url(url)
+        elif data and filename:
+            log.debug("Submitting file to Cuckoo Sandbox %s", api_url)
+            task_id = cuckoo_api.create_task(
+                filename=filename, fp=io.BytesIO(data)
+            )
+    except APIKeyError as e:
+        misperrors["error"] = "Failed to submit to Cuckoo: {}".format(e)
+        return misperrors
+
+    if not task_id:
+        misperrors["error"] = "File or URL submission failed"
+        return misperrors
+
+    return {
+        "results": [
+            {"types": "text", "values": "Cuckoo task id: {}".format(task_id)}
+        ]
+    }
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo["config"] = moduleconfig
+    return moduleinfo