MalFe

Please wait ...

Public Datasets

Crypt API Statistics of Ransomware Rows: 11430 | Cols: 14 | Reports Used: 3084

Description: This dataset explores the API calls that utilize Crypt functionality as outlined by the study S. H. Kok, A. Abdullah, and N. Z. Jhanjhi, “Early detection of crypto-ransomware using pre-encryption detection algorithm,” Journal of King Saud University - Computer and Information Sciences, vol. 34, no. 5, pp. 1984–1999, May 2022, doi: 10.1016/j.jksuci.2020.06.012.

Dataset SHA256: 1d77c1e8b05797c10503055f23d51b8dd675731f039823193b89c0176111ee4a

Features (sample):

	category	label	NtWriteVirtualMemory	UuidCreate	NtDelayExecution	NtSetInformationFile	NtWriteFile	CreateThread	NtReadVirtualMemory	VirtualFreeEx	CreateDirectoryW	VirtualProtectEx	SetFilePointer	SHA256
0	Ransomware	M	0	0	0	0	0	0	0	0	0	0	51	4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
1	Ransomware	M	0	0	0	0	0	0	0	0	2	0	0	4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
...	...	...	...	...	...	...	...	...	...	...	...	...	...	...
11428	Ransomware	M	0	0	0	0	0	0	0	0	0	0	1	eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5
11429	Ransomware	M	0	0	0	0	0	0	0	0	0	0	1	eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5

11430 rows × 14 columns

Created by: Avinash
Downloaded 3 times
Comments Enabled: True
Comments: 0
Related Dataset: API statistics of Ransomware

def process(data, filename, sha256, category, malicious):
    try:
        # Implement your data processing here, this function will get called with the data of each 
        # report in the category you have selected along with the filename of the report and hash. 
        # Do your processing and add your data to the features array, and return the features_lables, features, and sha256
        # PLEASE NOTE: THE CODE BELOW SERVES AS AN EXAMPLE ONLY! This example extracts the entropy of the PE Sections. Which can be seen here: https://malfe.cs.up.ac.za/datasets/view/Entropy_of_PE_Sections/5
        ###

features_labels = ["category", "label", "NtWriteVirtualMemory", "UuidCreate", "NtDelayExecution", "NtSetInformationFile", "NtWriteFile", "CreateThread", "NtReadVirtualMemory", "VirtualFreeEx", "CreateDirectoryW", "VirtualProtectEx", "SetFilePointer"]
        features = []
        noData = True
        label =   "M" if malicious else "B"
        if "behavior" in data:
            if "apistats" in data["behavior"]:
                for proc in data["behavior"]["apistats"]:
                    for key in data["behavior"]["apistats"][str(proc)].keys(): 
                        if key in features_labels:
                            tmp = [0]*len(features_labels)
                            tmp[0] = category
                            tmp[1] = label
                            tmp[features_labels.index(key)] = data["behavior"]["apistats"][str(proc)][key]
                            features.append(tmp)                 
                            noData = False   
        
        ###
        return features_labels, features, sha256
        
    except Exception as e:
        log("|process error| " + filename + " -> " + sha256 + " (" + str(e) + ")")
        pass

June 19, 2023, 11:36 a.m. Public Create New Vesion Download Dataset (1.1 MB)

Please wait ...

Public Datasets

Crypt API Statistics of Ransomware Rows: 11430 | Cols: 14 | Reports Used: 3084

Reports Used

Dataset Code

Comments

No comments to display