Idea for HASH vs Google Analyzer

Request Type

Analyzer

Description

Often the hashes added as observables can be easlily identified as malicious with a simple search on google.
So I'm wondering why run other analyzers (paid) to retrieve the same information?
We're using MechanicalSoup to search a list of malicious md5 in google and obtain a list of domains that help us to identify the md5 as malicious. (eg malwr.com, virscan.org, abuse.ch)

Possible workflow

Basically the concept is:

1. have an hash eg. 05ECFEC990F9D17B770312811E1E8B54
2. add as observable in the hive
3. run first google analyzer
4. if found in domains like hybrid-analysis.com, packettotal.com don't run other analyzers (this is the case)
5. if not found in google analyzer, run other (paid) analyzers

Problem is how to assign automatically the taxonomy score (found/not found is easy, but malicious / not malicious less)

Do you have any thought? Do you think that could be useful?

Start by reviewing the proposed Google-search workflow and the existing analyzer integrations described in the issue. Determine how a Google result would be represented and how the workflow could distinguish found indicators from malicious ones; completion criteria are not defined beyond avoiding unnecessary paid analyzer runs.