Step 14c/23 (Phase 3): Signatures — Implement MalwareBazaar SHA-256 fetcher

[Jordan231111]

Summary

Implement a Python script that fetches SHA-256 file hashes from the MalwareBazaar API and outputs them in the project's normalized format.

Depends On: Step 14a (Licensing matrix — MalwareBazaar must be approved)
Parent Issue: #12 (Integrate Real-World Malware Signatures)

Context

MalwareBazaar provides a free API for querying recent malware samples by SHA-256 hash. Attribution is required. This script fetches recent samples and extracts their hashes.

Key Changes

1. Create `python_scripts/fetch_malwarebazaar_hashes.py`:
   • Use MalwareBazaar API (`https://mb-api.abuse.ch/api/v1/\`) to fetch recent samples
   • Extract SHA-256 hashes and malware family names
   • Output normalized JSON: `[{"hash": "...", "hash_type": "sha256", "name": "...", "source": "malwarebazaar"}]`
   • Respect rate limits (document in script)
   • Support `--limit` flag for number of samples to fetch
2. Add `--output` flag for output file path
3. Handle API errors: rate limited, API down, malformed response

Acceptance Criteria

• Script fetches SHA-256 hashes from MalwareBazaar API
• Output format matches project's normalized signature schema
• Rate limits are respected and documented
• Graceful handling of API errors (rate limit, timeout, malformed response)
• Attribution requirement is documented
• Script can be run standalone and as part of the aggregator pipeline