Scanner, tests, fixtures, taste, config, and docs for ScanDonut

[ryanohoro]

Describe the change

This PR implements ScanDonut that decrypts and extracts Donut loader payloads using Volexity's donut-decrypt.

Describe testing procedures

Docker build completed successfully including new ScanDonut tests. Test fixtures were scanned successfully with Fileshot UI.

Sample output

{
  "strelka_response": [
    {
      "file": {
        "depth": 0,
        "flavors": {
          "mime": [
            "application/octet-stream"
          ],
          "yara": [
            "hacktool_win_shellcode_donut"
          ]
        },
        "name": "test_donut_compressed.bin",
        "scanners": [
          "ScanDonut",
          "ScanEntropy",
          "ScanFooter",
          "ScanHash",
          "ScanHeader",
          "ScanTlsh",
          "ScanYara"
        ],
        "size": 33002,
        "tree": {
          "node": "07ffe24e-b9da-48a7-937d-5bad840ab2e1",
          "root": "07ffe24e-b9da-48a7-937d-5bad840ab2e1"
        }
      },
      "request": {
        "attributes": {
          "filename": "test_donut_compressed.bin",
          "metadata": {
            "source": "fileshot-webui",
            "user_name": "strelka"
          }
        },
        "client": "fileshot-webui",
        "id": "07ffe24e-b9da-48a7-937d-5bad840ab2e1",
        "time": 1695782935
      },
      "scan": {
        "donut": {
          "donuts": [
            {
              "compression_type": "DONUT_COMPRESS_APLIB",
              "entropy_type": "DONUT_ENTROPY_DEFAULT",
              "instance_type": "DONUT_INSTANCE_EMBED",
              "instance_version": "1.0",
              "loader_version": "1.0_64",
              "module_type": "DONUT_MODULE_NET_DLL",
              "offset_loader_start": 7913,
              "offsets": {
                "encryption_start": 572,
                "size_instance": 4744
              }
            }
          ],
          "elapsed": 0.024509,
          "total": {
            "donuts": 1,
            "files": 1
          }
        },
        "entropy": {
          "elapsed": 0.000101,
          "entropy": 6.972027095872512
        },
        "footer": {
          "backslash": "\\x04\\x8bL$\\x08S\\x8a\\x02\\x84\\xc0t\\x13\\x8a\\x19\\x84\\xdbt\\r\\x80\\xcb \\x0c :\\xc3u\\x04BA\\xeb\\xe7\\x0f\\xbe\\x02\\x0f\\xbe\\t+\\xc1[\\xc3\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
          "elapsed": 0.000027,
          "footer": "\u0004�L$\bS�\u0002��t\u0013�\u0019��t\r�� \f :�u\u0004BA��\u000f�\u0002\u000f�\t+�[�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
        },
        "hash": {
          "elapsed": 0.005378,
          "md5": "f410d9cb56ebab60777757bab2db4cf8",
          "sha1": "68218b1986d4f96d14b53f85fd3d2939e80271a9",
          "sha256": "12fb9e49eb9577cad1068fbc3f16223ae6f28e3c9f57048dd06a836295a7f1cd",
          "ssdeep": "768:LT8x/bcS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0gf:X8hbcS7i9u6yeNejY6yFOB",
          "tlsh": "T1AFE26C92E7B141E4EBA2C051FC25AB1BEFB1308E40646ADB77144D816B23A30BF1C79D"
        },
        "header": {
          "backslash": "\\xe8\\xd5\\x1e\\x00\\x00\\xd5\\x1e\\x00\\x00\\xad\\xcb\\x0e\\xa0\\rmB\\xfb\\xb4\\xdfW\\xd7\\x0cT:\\xd9X%zo\\xca]\\x00\\xfb_\\xb9\\xf3'1\\x1e\\x0b`\\x00\\x00\\x00\\x00\\x01\\xe0\\xae\\xdeB",
          "elapsed": 0.000078,
          "header": "��\u001e\u0000\u0000�\u001e\u0000\u0000��\u000e�\rmB���W�\fT:�X%zo�]\u0000�_��'1\u001e\u000b`\u0000\u0000\u0000\u0000\u0001��B"
        },
        "tlsh": {
          "elapsed": 0.001535
        },
        "yara": {
          "elapsed": 0.002738,
          "matches": [
            "test"
          ]
        }
      }
    },
    {
      "file": {
        "depth": 1,
        "flavors": {
          "mime": [
            "application/vnd.microsoft.portable-executable"
          ],
          "yara": [
            "mz_file"
          ]
        },
        "scanners": [
          "ScanEntropy",
          "ScanFooter",
          "ScanHash",
          "ScanHeader",
          "ScanPe",
          "ScanTlsh",
          "ScanYara"
        ],
        "size": 4096,
        "source": "ScanDonut",
        "tree": {
          "node": "c32683b0-d00f-4168-8f76-ddf559bb76ad",
          "parent": "07ffe24e-b9da-48a7-937d-5bad840ab2e1",
          "root": "07ffe24e-b9da-48a7-937d-5bad840ab2e1"
        }
      },
      "request": {
        "attributes": {
          "filename": "test_donut_compressed.bin",
          "metadata": {
            "source": "fileshot-webui",
            "user_name": "strelka"
          }
        },
        "client": "fileshot-webui",
        "id": "07ffe24e-b9da-48a7-937d-5bad840ab2e1",
        "time": 1695782935
      },
      "scan": {
        "entropy": {
          "elapsed": 0.000049,
          "entropy": 4.314502621279276
        },
        "footer": {
          "backslash": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
          "elapsed": 0.000024,
          "footer": "\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
        },
        "hash": {
          "elapsed": 0.000187,
          "md5": "f58ebb5ce3e07a9dfc6dcca556b58291",
          "sha1": "67198a3ca72c49fb263f4a9749b4b79c50510155",
          "sha256": "f2f667e330da9f190eda77c74781963a0495c3953a653747fe475b99421efdda",
          "ssdeep": "48:6XZmqLorrAtzkuPS/6NMn3BCiLMjOiuCOlXTuZKFWpfbNtm:GmbWl8xCYDlTunzNt",
          "tlsh": "T1D281701183EA87B6E9334732BDB363804279FB41DCAB4B6F2884530B2D163544DA3F61"
        },
        "header": {
          "backslash": "MZ\\x90\\x00\\x03\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xff\\xff\\x00\\x00\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00",
          "elapsed": 0.000027,
          "header": "MZ�\u0000\u0003\u0000\u0000\u0000\u0004\u0000\u0000\u0000��\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"
        },
        "pe": { ... },
        "tlsh": {
          "elapsed": 0.00008
        },
        "yara": {
          "elapsed": 0.000061,
          "matches": [
            "test"
          ]
        }
      }
    }
  ]
}

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

[phutelmyer]

Looks good / tests good 👍