# -*- coding: utf-8 -*-
from __future__ import unicode_literals
import sys

from intelmq.lib import utils
from intelmq.lib.bot import Bot
from intelmq.lib.message import Event


class 
(Bot):

    def process(self):
        report = self.receive_message()

        if not report:
            self.acknowledge_message()
            return
        if not report.contains("raw"):
            self.acknowledge_message()

        raw_report = utils.base64_decode(report.value("raw"))

        raw_report = raw_report.split("<tbody>")[1]
        raw_report = raw_report.split("</tbody>")[0]
        raw_report_splitted = raw_report.split("<tr>")

        for row in raw_report_splitted:
            row = row.strip()

            if row == "":
                continue

            row_splitted = row.split("<td>")
            ip = row_splitted[1].split('">')[1].split("<")[0].strip()
            time_source = row_splitted[6].replace("</td></tr>", "").strip()
            time_source = time_source + " 00:00:00 UTC"

            event = Event(report)

            event.add('time.source', time_source, sanitize=True)
            event.add('classification.type', u'malware')
            event.add('source.ip', ip, sanitize=True)
            event.add('raw', row, sanitize=True)

            self.send_message(event)
        self.acknowledge_message()

if __name__ == "__main__":
    bot = MalwareGroupIPsParserBot(sys.argv[1])
    bot.start()

MalwareGroupIPsParserBot