import urllib2
import re

print """\n# Malware analysis related scripts:
# https://github.com/notnop
# Happy reversing\n"""

output_file = "malware_colection.txt"

# construct user agents
useragent = {'User-Agent': "Mozilla/5.0 (Windows NT 6.1; Win32; x86; rv:54.0) Gecko/20100101 Firefox/54.0"}


def scrie_continut(lista):
    for i in lista:
        if i[:7] != "http://":
            i = "http://" + i
        with open(output_file, "a") as handle:
            handle.write(i + "\n")
        handle.close()


# VxVault - aka siri
def vxvault(nr_samples):

    lista_url = []
    adresa = "http://vxvault.net/ViriList.php?s=0&m=" + str(nr_samples)

    try:
        req = urllib2.Request(adresa, None, useragent)
        continut_pagina = urllib2.urlopen(req).read()

    except Exception as e:
        print "vxvault: " + str(e)

    # find all malware address
    pagina = continut_pagina.split("\r")
    for i in pagina:
        match = re.search("href='ViriFiche\.php\?ID=[\d]+'>(.+)</a></TD>", i)
        if match:
            temp_mal_address = match.group(1)
            if not re.search("[\d]{1,2}-[\d]{1,2}", temp_mal_address):

                # add malware address
                lista_url.append(temp_mal_address)

    # scrie urlurile in fisier
    scrie_continut(lista_url)

    # am terminat
    print "*   VxVault - Done ", len(lista_url)


# Malcode
def Malcode():
    lista_url = []

    # browsing pages
    for i in range(0, 10):
        adresa = "http://malc0de.com/database/?&page=" + str(i)

        try:
            req = urllib2.Request(adresa, None, useragent)
            continut = urllib2.urlopen(req, timeout=60).read()
            b = re.findall("<td>[\d]{4}-[\d]{2}-[\d]{2}<\/td>\n.+\n", continut)
            if b:
                for i in b:
                    data = re.search("<td>([\d]{4}-[\d]{2}-[\d]{2})<\/td>", i)
                    malware = re.search("\t<td>(.+)<\/td>", i)
                    if data and malware:
                        malware = re.sub("<br\/>", "", malware.group(1))
                        lista_url.append(malware)
        except Exception as e:
            print "Malcode: " + str(e)

    scrie_continut(lista_url)
    print "*   Malcode - Done ", len(lista_url)


# get samples address:
vxvault(250)
Malcode()

print "Your collection is in: ", output_file
exit()
