# malware_grabber.py
# Copyright 2004-present Facebook. All Rights Reserved.

from __future__ import print_function

import base64
import cStringIO
import hashlib
import json
import os
import zipfile
from urllib import urlencode
from urllib2 import urlopen
from urlparse import urlunparse

fb_app_id = '<YOUR-APP-ID>'
access_token = '<YOUR-APP-SECRET>'
input_md5s_filename = 'md5s.txt'
output_dir = 'out'

md5s = []
with open(input_md5s_filename) as f:
  for l in f:
    md5s.append(l.strip())

print('Fetching %d MD5s' % len(md5s))

for md5 in md5s:
  query = urlencode({
    'access_token' : access_token,
    'query_type' : 'HASH',
    'hash_type' : 'MD5',
    'hash_value' : md5,
    'fields' : 'password,sample'
  })
  url = urlunparse(('https', 'graph.facebook.com', '/' + fb_app_id + '/malware_analyses', '', query, ''))
  try:
    # the response is a 'data' object, which is a list of objects
    resp = json.loads(urlopen(url).read())['data'][0]
  except Exception as e:
    print('Failed to load "%s": %s' % (md5, str(e)))
    continue
  zipfilehandle = cStringIO.StringIO()
  zipfilehandle.write(base64.b64decode(resp['sample']))
  with zipfile.ZipFile(zipfilehandle, 'r') as zf:
    for entry in zf.infolist():
      with open(os.path.join(output_dir, entry.filename), 'w') as f:
        print('Writing to %s' % entry.filename)
        f.write(zf.read(entry.filename, resp['password']))

d5138d0b9ac9388c91dbd8ac1c133fb07f67c1b7
<mask token>

<mask token>
with open(input_md5s_filename) as f:
    for l in f:
        md5s.append(l.strip())
print('Fetching %d MD5s' % len(md5s))
for md5 in md5s:
    query = urlencode({'access_token': access_token, 'query_type': 'HASH',
        'hash_type': 'MD5', 'hash_value': md5, 'fields': 'password,sample'})
    url = urlunparse(('https', 'graph.facebook.com', '/' + fb_app_id +
        '/malware_analyses', '', query, ''))
    try:
        resp = json.loads(urlopen(url).read())['data'][0]
    except Exception as e:
        print('Failed to load "%s": %s' % (md5, str(e)))
        continue
    zipfilehandle = cStringIO.StringIO()
    zipfilehandle.write(base64.b64decode(resp['sample']))
    with zipfile.ZipFile(zipfilehandle, 'r') as zf:
        for entry in zf.infolist():
            with open(os.path.join(output_dir, entry.filename), 'w') as f:
                print('Writing to %s' % entry.filename)
                f.write(zf.read(entry.filename, resp['password']))

<mask token>
fb_app_id = '<YOUR-APP-ID>'
access_token = '<YOUR-APP-SECRET>'
input_md5s_filename = 'md5s.txt'
output_dir = 'out'
md5s = []
with open(input_md5s_filename) as f:
    for l in f:
        md5s.append(l.strip())
print('Fetching %d MD5s' % len(md5s))
for md5 in md5s:
    query = urlencode({'access_token': access_token, 'query_type': 'HASH',
        'hash_type': 'MD5', 'hash_value': md5, 'fields': 'password,sample'})
    url = urlunparse(('https', 'graph.facebook.com', '/' + fb_app_id +
        '/malware_analyses', '', query, ''))
    try:
        resp = json.loads(urlopen(url).read())['data'][0]
    except Exception as e:
        print('Failed to load "%s": %s' % (md5, str(e)))
        continue
    zipfilehandle = cStringIO.StringIO()
    zipfilehandle.write(base64.b64decode(resp['sample']))
    with zipfile.ZipFile(zipfilehandle, 'r') as zf:
        for entry in zf.infolist():
            with open(os.path.join(output_dir, entry.filename), 'w') as f:
                print('Writing to %s' % entry.filename)
                f.write(zf.read(entry.filename, resp['password']))

from __future__ import print_function
import base64
import cStringIO
import hashlib
import json
import os
import zipfile
from urllib import urlencode
from urllib2 import urlopen
from urlparse import urlunparse
fb_app_id = '<YOUR-APP-ID>'
access_token = '<YOUR-APP-SECRET>'
input_md5s_filename = 'md5s.txt'
output_dir = 'out'
md5s = []
with open(input_md5s_filename) as f:
    for l in f:
        md5s.append(l.strip())
print('Fetching %d MD5s' % len(md5s))
for md5 in md5s:
    query = urlencode({'access_token': access_token, 'query_type': 'HASH',
        'hash_type': 'MD5', 'hash_value': md5, 'fields': 'password,sample'})
    url = urlunparse(('https', 'graph.facebook.com', '/' + fb_app_id +
        '/malware_analyses', '', query, ''))
    try:
        resp = json.loads(urlopen(url).read())['data'][0]
    except Exception as e:
        print('Failed to load "%s": %s' % (md5, str(e)))
        continue
    zipfilehandle = cStringIO.StringIO()
    zipfilehandle.write(base64.b64decode(resp['sample']))
    with zipfile.ZipFile(zipfilehandle, 'r') as zf:
        for entry in zf.infolist():
            with open(os.path.join(output_dir, entry.filename), 'w') as f:
                print('Writing to %s' % entry.filename)
                f.write(zf.read(entry.filename, resp['password']))

# malware_grabber.py
# Copyright 2004-present Facebook. All Rights Reserved.

from __future__ import print_function

import base64
import cStringIO
import hashlib
import json
import os
import zipfile
from urllib import urlencode
from urllib2 import urlopen
from urlparse import urlunparse

fb_app_id = '<YOUR-APP-ID>'
access_token = '<YOUR-APP-SECRET>'
input_md5s_filename = 'md5s.txt'
output_dir = 'out'

md5s = []
with open(input_md5s_filename) as f:
  for l in f:
    md5s.append(l.strip())

print('Fetching %d MD5s' % len(md5s))

for md5 in md5s:
  query = urlencode({
    'access_token' : access_token,
    'query_type' : 'HASH',
    'hash_type' : 'MD5',
    'hash_value' : md5,
    'fields' : 'password,sample'
  })
  url = urlunparse(('https', 'graph.facebook.com', '/' + fb_app_id + '/malware_analyses', '', query, ''))
  try:
    # the response is a 'data' object, which is a list of objects
    resp = json.loads(urlopen(url).read())['data'][0]
  except Exception as e:
    print('Failed to load "%s": %s' % (md5, str(e)))
    continue
  zipfilehandle = cStringIO.StringIO()
  zipfilehandle.write(base64.b64decode(resp['sample']))
  with zipfile.ZipFile(zipfilehandle, 'r') as zf:
    for entry in zf.infolist():
      with open(os.path.join(output_dir, entry.filename), 'w') as f:
        print('Writing to %s' % entry.filename)
        f.write(zf.read(entry.filename, resp['password']))
