mastiff.conf

# This is the configuration file for mastiff.
#
# Comments are preceded by a # or ;
#

[Dir]
# log_dir is the base directory where the logs generated will
# be placed in.
#log_dir = /usr/local/mastiff/log
log_dir = ./work/log

# plugin_dir is a list of directories test plugins may be present in.
# should be comma-separated.
# This may be left blank.
# For example:
#plugin_dir = ./plugins, /etc/mastiff
plugin_dir = 

# output_plugin_dir is a list of directories test output plugins may be present in.
# should be comma-separated.
# This may be left blank.
# For example:
#output_plugin_dir = ./plugins, /etc/mastiff
output_plugin_dir = 

[Misc]
# verbose = [on|off]
verbose = off
# Make a copy of the analyzed file in the log directory with a .VIR extension.
# copy = [on|off]
copy = on

[Sqlite]
# Sqlite database options
# db_file = Name of the database file
db_file = mastiff.db

[File ID]
# trid is the location of the TrID binary
# trid_db is the location of the TrID database
#trid = /usr/local/bin/trid
trid = 
trid_db = 

[Fuzzy Hashing]
# compare decides whether or not to correlate previous fuzzy hashes
# compare = [on|off]
compare = on

[Hex Dump]
# Options for Hex Dump plug-in
# enabled = [on|off]
enabled = off

[Embedded Strings Plugin]
# Options for the Embedded Strings Plugin.
# strcmd is the path to the strings command
# DO NOT CHANGE THE FOLLOWING OPTIONS UNLESS YOU KNOW WHAT YOU ARE DOING!
# str_opts are the options to use for all strings operations
# str_uni_opts are the options to use to obtain UNICODE strings
strcmd = /usr/bin/strings
str_opts = -a -t d
str_uni_opts = -e l

[VirusTotal]
# Options for the VirusTotal Submission Plug-in.
# api_key is your API key from virustotal.com
#   - Leave this empty if you wish to disable this plug-in
api_key = 

# submit [on|off] - submit binary to VirusTotal
submit = off

[Metascan Online]
# Options for the Metascan Online Submission Plug-in.
# api_key is your API key from metascan-online.com
#   - Leave this empty if you wish to disable this plug-in
api_key = 

# submit [on|off] - submit binary to Metascan Online
submit = off

[MASTIFF Online]
# Options for submission to MASTIFF Online
# accept_terms_of_service [true|false] - To upload samples to MASTIFF Online,
#  you agree to the terms of service and privacy policy located at 
# https://mastiff-online.korelogic.com. Set the option below to true to 
# indicate you agree to the terms.
accept_terms_of_service = false
# submit [on|off] - submit sample to MASTIFF Online
submit = off

[pdfid]
# Options to run Didier Stevens pdfid.py script
# pdfid_cmd = Path to the pdfid.py script
#   - Leave blank if you want the script disabled.
# pdfid_opts = Options for program.
#   - Do not put multiple options in quotes.
# Note: pdfid.py has bugs that may cause errors when examining
#       malformed PDFs when using the -e option.
pdfid_cmd = /usr/local/bin/pdfid.py
#pdfid_opts = -e
pdfid_opts =

[pdf-parser]
# Options to run Didier Stevens pdf-parser.py script
# pdf_cmd = Path to pdf-parser.py.
# feedback: [on|off] - Feed extracted files back into the MASTIFF queue.
pdf_cmd = /usr/local/bin/pdf-parser.py
feedback = on

[PDF Metadata]
# Options for PDF Metadata script
# exiftool = path to exitfool
exiftool = /usr/bin/exiftool

[yara]
# Options for the Yara signature plug-in
# yara_sigs = Base path to Yara signatures. This path will be recursed
#             to find additional signatures.
#             Leave blank to disable the plug-in.
yara_sigs = /usr/local/yara

[Digital Signatures]
# Options to extract the digital signatures
#
# disitool - path to disitool.py script.
# openssl - path to openssl binary
disitool = /usr/local/bin/disitool.py
openssl = /usr/bin/openssl

[Office Metadata]
# Options for Office Metadata script
# exiftool = path to exitfool
exiftool = /usr/bin/exiftool

[Single-Byte Strings]
# options for single-byte string extraction plug-in
# length - Minimum length to extract
length = 3
# raw - print raw characters instead of formatted ones (e.g. \\n vs. \n)
raw = False

[ZipExtract]
# options for Zip archive file extraction plug-in
# enabled: [on|off] - Extract files or not
# password: Password to use for zip file. OK to leave blank.
# feedback: [on|off] - Feed extracted files back into the MASTIFF queue.
enabled = on
password =
feedback = on

[Office pyOLEScanner]
# olecmd = Path to pyOLEScanner.py
olecmd=/usr/local/src/pyOLEScanner/pyOLEScanner.py

################################
# Output Plug-in Configuration
################################

[Raw Output]
# enabled: [on|off] - Dump output in raw form or not
enabled = off

[Text Output]
# enabled = [on|off] - Dump output in raw form or not
# format = [multiple|single] - Put text output in individual files or one page.
enabled = on
format = multiple