forensic-hashdb 0.2.0

File hash databases for digital forensics — NSRL/CIRCL known-good, malware known-bad, known-vulnerable Windows drivers (loldrivers), and analyst-supplied MD5/SHA1/SHA256 feeds.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

/// Source database a known-bad hash came from.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum BadFileSource {
    MalwareBazaar,
    VirusShare,
    Malshare,
    AlienVaultOtx,
    Custom(&'static str),
}

/// Provenance record for a known-bad file hash.
#[derive(Debug, Clone)]
pub struct BadFileInfo {
    pub sha256: [u8; 32],
    pub source: BadFileSource,
    pub malware_family: Option<String>,
    pub tags: Vec<String>,
}

/// A known-vulnerable or known-malicious Windows driver.
#[derive(Debug, Clone)]
pub struct DriverInfo {
    pub name: &'static str,
    pub sha256: [u8; 32],
    pub cves: &'static [&'static str],
    pub description: &'static str,
}