Add support for VMRay sandbox results for capa dynamic analysis

[mr-tz]

We're working on adding support to parse VMRay result files for capa dynamic processing.

To add this functionality tasks include:

• identify relevant VMRay files, so far flog.xml and summary_v2.json
• add the respective pydantic models to parse relevant data
• add a VMRayExtractor
  • add base extractor
  • add scope extractors

Tasks

Beta Give feedback

1. undo formatting changes / apply correct lints/formatting
2. complete extractor.py implementation analogous to CAPE (almost done)
3. complete/cleanup call.py
4. complete/cleanup file.py
5. complete global.py
6. add process.py - get_threads(?)
7. complete/cleanup models.py
8. add test archives - clarify if/how can publish
9. add tests/test_vmray_models.py to test VMRay models
10. add tests/test_vmray_features.py to test feature presence and counts

[mike-hunhoff]

The source file appears to be stored under <archive>/internal/static_anlayses/<sha256>/objects/files/<sha256>. We'll need to reference the source file to emit string features at the file scope as this information doesn't appear to be stored elsewhere

[mike-hunhoff]

The VMRay analysis archive contains memory dumps for all monitored processes. We should consider emitting features, e.g. string, from all or a subset of these memory dumps to help detect capabilities. Performance may be an issue here as VMRay generates MANY memory dumps during execution and most appear to be junk. We may be able to narrow our focus to the initial process created for the target sample, although we could be missing interesting data in the child processes.

[mr-tz]

closed via #2208

[mr-tz]

The VMRay analysis archive contains memory dumps for all monitored processes. We should consider emitting features, e.g. string, from all or a subset of these memory dumps to help detect capabilities. Performance may be an issue here as VMRay generates MANY memory dumps during execution and most appear to be junk. We may be able to narrow our focus to the initial process created for the target sample, although we could be missing interesting data in the child processes.

@mike-hunhoff should we track this separately?