code: # Copyright (C) 2014 Claudio "nex" Guarnieri (@botherder), Accuvant, Inc. (dummy@email.com)
  #
  # This program is free software: you can redistribute it and/or modify
  # it under the terms of the GNU General Public License as published by
  # the Free Software Foundation, either version 3 of the License, or
  # (at your option) any later version.
  #
  # This program is distributed in the hope that it will be useful,
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  # GNU General Public License for more details.
  #
  # You should have received a copy of the GNU General Public License
  # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  
  from lib.cuckoo.common.abstracts import Signature
  
  class Unhook(Signature):
      name = "antisandbox_unhook"
      description = "Tries to unhook or modify Windows functions monitored by Cuckoo"
      severity = 3
      confidence = 60
      categories = ["anti-sandbox"]
      authors = ["nex","Accuvant"]
      minimum = "1.2"
      evented = True
  
      filter_categories = set(["__notification__"])
  
      def __init__(self, *args, **kwargs):
          Signature.__init__(self, *args, **kwargs)
          self.saw_unhook = False
          self.unhook_info = set()
  
      def on_call(self, call, process):
          subcategory = self.check_argument_call(call,
                                                 api="__anomaly__",
                                                 name="Subcategory",
                                                 pattern="unhook")
          if subcategory:
              self.saw_unhook = True
              funcname = self.get_argument(call, "FunctionName")
              if funcname != "":
                  if (funcname != "SetUnhandledExceptionFilter" and funcname != "SetWindowsHookExW" and funcname != "UnhookWindowsHookEx" and
                      funcname != "CoCreateInstance") or self.get_argument(call, "UnhookType") != "modification":
                      self.unhook_info.add("function_name: " + funcname + ", type: " + self.get_argument(call, "UnhookType"))
      
      def on_complete(self):
          if len(self.unhook_info) > 5:
              weight = len(self.unhook_info)
              confidence = 100
  
          if not self.unhook_info:
              self.saw_unhook = False
  
          for info in self.unhook_info:
              self.data.append({"unhook" : info })
          return self.saw_unhook
  
entities: [['EMAIL_ADDRESS', 'dummy@email.com'], ['DATE_TIME', '2014'], ['PERSON', 'Claudio'], ['PERSON', 'Guarnieri'], ['PERSON', 'api="__anomaly'], ['URL', 'http://www.gnu.org/licenses/'], ['URL', 'email.com'], ['URL', 'lib.cuckoo.com'], ['URL', 'self.sa'], ['URL', 'self.ch'], ['URL', 'self.sa'], ['URL', 'self.ge'], ['URL', 'self.ge'], ['URL', 'info.ad'], ['URL', 'self.ge'], ['URL', 'self.sa'], ['URL', 'self.sa']]