base on VirusTotal Wanna Be - Now with 100% more Hipster  # malice [](https://circleci.com/gh/maliceio/malice) [](LICENSE) [](https://github.com/gmaliceio/malice/releases/latest) [](https://www.blackhat.com/us-18/arsenal/schedule/index.html#maliceio-12000) [](https://gitter.im/maliceio/malice) > Malice's mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company. --- ## Try It Out > **DEMO:** [demo.malice.io](<https://demo.malice.io/app/kibana#/discover?_g=(refreshInterval:(pause:!t,value:0),time:(from:'2018-09-03T04:00:00.000Z',mode:absolute,to:'2018-09-10T04:00:00.000Z'))&_a=(columns:!(_source),index:afe16d30-b234-11e8-84d2-4fddc6da27ff,interval:auto,query:(language:lucene,query:''),sort:!(scan_date,desc))>) - **username**: `malice` - **password**: `ecilam` ## Requirements ### Hardware - ~16GB disk space - ~4GB RAM ### Software - [Docker](https://docs.docker.com) ## Getting Started (OSX) ### Install ```bash $ brew install maliceio/tap/malice ``` ``` Usage: malice [OPTIONS] COMMAND [arg...] Open Source Malware Analysis Framework Version: 0.3.11 Author: blacktop - <https://github.com/blacktop> Options: --debug, -D Enable debug mode [$MALICE_DEBUG] --help, -h show help --version, -v print the version Commands: scan Scan a file watch Watch a folder lookup Look up a file hash elk Start an ELK docker container plugin List, Install or Remove Plugins help Shows a list of commands or help for one command Run 'malice COMMAND --help' for more information on a command. ``` ### Scan some _malware_ ```bash $ malice scan evil.malware ``` > **NOTE:** On the first run malice will download all of it's default plugins which can take a while to complete. Malice will output the results as a markdown table that can be piped or copied into a **results.md** that will look great on Github see [here](docs/examples/scan.md) ### Start Malice's Web UI ```bash $ malice elk ``` > You can open the [Kibana](https://www.elastic.co/products/kibana) UI and look at the scan results here: <http://localhost> (_assuming you are using Docker for Mac_)  - Type in **malice** as the `Index name or pattern` and click **Create**. - Now click on the `Malice Tab` and **behold!!!**  ## Getting Started (_Docker in Docker_) [](https://circleci.com/gh/maliceio/malice) [](https://hub.docker.com/r/malice/engine/) [](https://hub.docker.com/r/malice/engine/) [](https://hub.docker.com/r/malice/engine/) ### Install/Update all Plugins ```bash docker run --rm -v /var/run/docker.sock:/var/run/docker.sock malice/engine plugin update --all ``` ### Scan a file ```bash docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v `pwd`:/malice/samples \ --network="host" \ -e MALICE_VT_API=$MALICE_VT_API \ malice/engine scan SAMPLE ``` ## Documentation - [Documentation](docs) - [Plugins](docs/plugins) - [Examples](docs/examples) - [Roadmap](docs/roadmap) - [Contributing](CONTRIBUTING.md) ### Known Issues :warning: #### If you are having issues with `malice` connecting/writting to `elasticsearch` please see the following: I have noticed when running the new **5.0+** version of [malice/elasticsearch](https://github.com/maliceio/elasticsearch) on a linux host you need to increase the memory map areas with the following command ```bash sudo sysctl -w vm.max_map_count=262144 ``` Elasticsearch requires a **LOT** of RAM to run smoothly. You can lower it to **2GB** by running the following _(**before running a scan**)_: ```bash $ docker run -d \ -p 9200:9200 \ --name malice-elastic \ -e ES_JAVA_OPTS="-Xms2g -Xmx2g" \ malice/elasticsearch ``` #### See here for more details on [Known Issues/FAQs](https://github.com/maliceio/malice/blob/master/docs/KnownBugs.md) :warning: ### Issues Find a bug? Want more features? Find something missing in the documentation? Let me know! Please don't hesitate to [file an issue](https://github.com/maliceio/malice/issues/new) ### CHANGELOG See [`CHANGELOG.md`](https://github.com/maliceio/malice/blob/master/CHANGELOG.md) ### License Apache License (Version 2.0)<br> Copyright (c) 2013 - 2018 **blacktop** <!-- [](https://malice-slack.herokuapp.com) --> ", Assign "at most 3 tags" to the expected json: {"id":"4869","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"