Object types

class mwdblib.MWDBObject(api: mwdblib.api.api.APIClient, data: Dict[str, Any])[source]

Represents abstract, generic MWDB object.

Should never be instantiated directly.

If you really need to get synthetic instance - use internal create() static method.

add_child(child: Union[MWDBObject, str]) → None[source]

Adds reference to child with current object as parent

Parameters

child (MWDBObject or str) – Object or object identifier (sha256)

add_comment(comment: str) → None[source]

Adds comment

Parameters

comment (str) – Comment string

add_metakey(key: str, value: str) → None[source]

Adds metakey attribute

Deprecated since version 4.0.0: For MWDB Core >=2.6.0 use add_attribute instead

Parameters
  • key (str) – Attribute key

  • value (str) – Attribute value

add_tag(tag: str) → None[source]

Tags object using specified tag

Parameters

tag (str) – Tag string

property analyses

Returns list of Karton analyses related with this object

Requires MWDB Core >= 2.3.0.

New in version 4.0.0.

property attributes

Returns dict object with attributes.

Requires MWDB Core >= 2.6.0.

New in version 4.0.0.

Returns

Dict object containing attributes

property children

Returns list of child objects

Returns

List of child objects

property comments

Returns list of comments

Returns

List of comment objects

Example - print all comments of last object commented as “malware”:

comments = next(mwdb.search_files('comment:"*malware*"')).comments
for comment in comments:
    print("{} {}".format(comment.author, comment.comment))
property content

Returns stringified contents of object

New in version 3.0.0: Added MWDBObject.content property

static create(api: mwdblib.api.api.APIClient, data: Dict[str, Any]) → mwdblib.object.MWDBObject[source]

Creates specialized MWDBObject subclass instance based on specified data

flush() → None[source]

Flushes local object state in case of pending updates. All object-specific properties will be lazy-loaded using API

property id

Object identifier (sha256)

property metakeys

Returns dict object with metakeys.

Deprecated since version 4.0.0: For MWDB Core >=2.6.0 use attributes instead

Returns

Dict object containing metakey attributes

property object_type

Object type (‘file’, ‘static_config’ or ‘text_blob’)

property parents

Returns list of parent objects

Returns

List of parent objects

remove() → None[source]

Remove specific object from mwdb

The object should be treated as invalidated after using this method .

remove_tag(tag: str) → None[source]

Untags object using specified tag

Parameters

tag (str) – Tag string

property sha256

Object identifier (sha256)

share_with(group: str) → None[source]

Share object with specified group

New in version 3.0.0: Added MWDBObject.share_with() method

Parameters

group (str) – Group name

property shares

Returns list of shares

Returns

List of share objects

property tags

Returns list of tags

Returns

List of tags

property upload_time

Returns timestamp of first object upload

Returns

datetime object with object upload timestamp

class mwdblib.MWDBFile(api: mwdblib.api.api.APIClient, data: MWDBElementData)[source]
property config

Returns latest config related with this object

Return type

MWDBConfig or None

Returns

Latest configuration if found

property content

Returns file contents, calling MWDBFile.download() if contents were not loaded yet

property file_name

Sample original name

property file_size

Sample size in bytes

property file_type

Sample type

property name

Alias for file_name property

property size

Alias for file_size property

property type

Alias for file_type property

class mwdblib.MWDBConfig(api: mwdblib.api.api.APIClient, data: Dict[str, Any])[source]
property cfg

Raw dict object with configuration

See also

config_dict

property config

dict object with configuration. In-blob keys are mapped to MWDBBlob objects.

property config_dict

Raw dict object with configuration (in-blob keys are not mapped to MWDBBlob objects)

property content

Returns raw dict object as JSON bytes

Return type

bytes

property family

Configuration family

property type

Configuration type (‘static’ or ‘dynamic’)

class mwdblib.MWDBBlob(api: mwdblib.api.api.APIClient, data: Dict[str, Any])[source]
property blob_name

Blob name

property blob_size

Blob size in bytes

property blob_type

Blob semantic type

property config

Returns latest config related with this object

Returns

Latest configuration if found

property content

Contains blob content

Changed in version 3.0.0: Returned type is guaranteed to be utf8-encoded bytes

property last_seen
Returns

datetime object when blob was last seen in MWDB

property name

Alias for blob_name property

property size

Alias for blob_size property

property type

Alias for blob_type property