require 'ipaddr' def submit # If this request has a file parameter, it is an file upload and doesn't need to be processed if params["file"].nil? begin # Create a new incident i = Incident.new i.url = params["url"] i.source_host = SourceHost.find_or_create_by_address(IPAddr.new(params["source_host"].to_i, Socket::AF_INET).to_s) i.target_host = TargetHost.find_or_create_by_address(IPAddr.new(params["target_host"].to_i, Socket::AF_INET).to_s) i.trigger = params["trigger"] # Does the sample already exist? i.malware_sample = MalwareSample.find_by_sha512(params["sha512"]) if i.malware_sample.nil? i.malware_sample = MalwareSample.new( :md5 => params["md5"], :sha512 => params["sha512"], :filename => params["filename"] ) i.malware_sample.file_type = FileType.find_or_create_by_description(params["filetype"]) end i.save render :text => ((i.malware_sample.file.nil?) ? "S_FILEREQUEST" : "S_FILEKNOWN") rescue Exception => e logger.error "ERROR: #{e.to_s}" render :text => "S_ERROR" end else begin m = MalwareSample.find_by_sha512(params["sha512"]) if m.nil? raise "MalwareSample not found in the database" else m.file = params["file"].read m.packer = Packer.getPacker(m) m.task_id = MalwareSample.submitAnubis(m) m.save # Send our email to virustotal Notifier.deliver_to_virustotal(m) render :text => "S_FILEOK" end rescue Exception => e logger.error "ERROR: #{e.to_s}" render :text => "S_ERROR" end end end end