-- .lua
--
--  Malware lookup 
--
TrisulPlugin = {

  id = {
    name = "file extraction  ",
    description = "various aspects of file extraction ",
    author = "Unleash",
    version_major = 1,
    version_minor = 0,
  },


  --
  filex_monitor  = {


    -- save all content to /tmp/kk 
    --
    onfile_http  = function ( engine, timestamp, flowkey, path, req_header, resp_header, length )

      local h = io.popen("sha1sum "..path)
      local outputstr  = h:read("*a")
      h:close()

      T.async:schedule( 
      {
        data = outputstr, 

        onexecute = function( indata) 
          local hashval  = indata:match("(%x+)")

          local cymru_command = "whois -h hash.cymru.com ".. hashval;
          local h = io.popen(cymru_command)
          local outputstr  = h:read("*a")
          local h,last_seen,count = outputstr:match("(%x+)%s+(%d+)%s+(%d+)")

          if not h then 
              return outputstr
          end


        end,

        onresult = function(engine, req, response)
          print("GOTTTT MALWARE ".. response)
        end
      }
      )

    end,

  }

}

