Cuckoo for Cuckoo Box

Cuckoo Sandbox is an automated, open source, malware analysis system that started as a Google Summer of Code project in 2010 and recently released version 0.3 in December of 2011. I am a big fan of the project, and I am excited to see what they have up their sleeves for subsequent releases. The ability to create customized analysis packages and to extend existing code to fit unique use cases couldn't be easier. Documentation exists and is actually helpful.

Now that I've sung the Cuckoo praise song, I wanted to pass along a bit of help to anyone who wants to get it running on Mac OS X. Now to be fair the documentation recommends a GNU/Linux setup, preferably Ubuntu. So while Mac isn't the first choice, you can definitely get it up and running with minimal effort.

Specifically the issue I ran into came when I was installing two of the required Python libraries: python-magic and pyssdeep. Even if you don't have these libraries installed at all, everything will still run, but you will miss out on file type info and fuzzy hashing goodness in your analysis reports. After installing both libraries I still wasn't getting the output I was expecting. I dug around and discovered that there are multiple versions of both of these libraries and the interfaces to them are not identical. How unfortunate. So, to keep a long story short, I modified the code of file.py located at cuckoo/cuckoo/processing/file.py starting on line 109 to the following (my additions in red):

    def _get_ssdeep(self):                                                                                                                                                                   
        """
        Generates the ssdeep fuzzy hash of the file.
        @return: ssdeep fuzzy hash of the file
        """
        if not IS_SSDEEP:
            return None

        try:
            return ssdeep.ssdeep().hash_file(self.file_path)
        except:
try:
 import ssdeep
 return ssdeep.hash_from_file(self.file_path)
 except:
 return None
        return None

    def _get_type(self):
        """
        Retrieves the libmagic type of the file.
        @return: file type
        """
        if not IS_MAGIC:
            return None

        try:
            ms = magic.open(magic.MAGIC_NONE)
            ms.load()
            return ms.buffer(self.file_data)
        except:
 try:
 return magic.Magic().from_file(self.file_path)
 except:
return None
        return None

Assuming you have both libraries installed correctly to begin with, which ever version you chose, this should work for you either way. Happy Hunting!