service_manifest.yml

name: DeobfuScripter
version: $SERVICE_TAG
description: Static script de-obfuscator. The purpose is not to get surgical de-obfuscation, but rather to extract obfuscated IOCs.

# Regex defining the types of files the service accepts and rejects
accepts: code/.*
rejects: empty|metadata/.*

# At which stage the service should run (one of FILTER, EXTRACT, CORE, SECONDARY, POST, REVIEW)
# NOTE: Stages are executed in the order defined in the list
stage: CORE
# Which category the service is part of (one of Antivirus, Dynamic Analysis, External, Extraction, Filtering, Internet Connected, Networking, Static Analysis)
category: Static Analysis

# Does the service require access to the file to perform its task
# If set to false, the service will only have access to the file metadata (e.g. Hashes, size, type, ...)
file_required: true
# Maximum execution time the service has before it's considered to be timed out
timeout: 420

# is the service enabled by default
enabled: true
privileged: true

submission_params:
  - default: false
    name: extract_original_iocs
    type: bool
    value: false

  - name: max_file_size
    type: int
    value: 5000000
    default: 5000000

heuristics:
  - description: Obfuscation techniques were found and de-obfuscated in the file
    filetype: code/.*
    heur_id: 1
    name: Obfuscation
    score: 10
    max_score: 1000

  - description: IOCs were found after simple de-obfuscation
    filetype: code/.*
    heur_id: 5
    name: Lightly De-obfuscated IOCs
    score: 50

  - description: IOCs were found only after layered de-obfuscations
    filetype: code/.*
    heur_id: 6
    name: De-obfuscated IOCs
    score: 100

  - description: The service found interesting files during the de-obfuscation
    filetype: code/.*
    heur_id: 8
    name: De-obfuscated file
    score: 10

docker_config:
  image: ${REGISTRY}cccs/assemblyline-service-deobfuscripter:$SERVICE_TAG
  cpu_cores: 1.0
  ram_mb: 2048