Skip to content

Commit

Permalink
fix
Browse files Browse the repository at this point in the history
  • Loading branch information
Andriy Brukhovetskyy committed Jan 22, 2025
1 parent f426337 commit 1556340
Show file tree
Hide file tree
Showing 4 changed files with 36 additions and 5 deletions.
4 changes: 4 additions & 0 deletions conf/default/selfextract.conf.default
Original file line number Diff line number Diff line change
Expand Up @@ -95,3 +95,7 @@ timeout = 60
[overlay]
enabled = yes
timeout = 60

[UnGPG_extract]
enabled = no
timeout = 60
27 changes: 25 additions & 2 deletions lib/cuckoo/common/integrations/file_extra_info.py
Original file line number Diff line number Diff line change
Expand Up @@ -443,6 +443,7 @@ def generic_file_extractors(
eziriz_deobfuscate,
office_one,
msix_extract,
UnGPG_extract,
]

futures = {}
Expand Down Expand Up @@ -850,8 +851,8 @@ def SevenZip_unpack(file: str, *, filetype: str, data_dictionary: dict, options:
if any(
"7-zip Installer data" in string for string in data_dictionary.get("die", [])
) or "Zip archive data" in data_dictionary.get("type", ""):
tool = "7Zip"
prefix = "7zip_"
tool = "SevenZip"
prefix = "SevenZip_"
password = options.get("password", "infected")
password = f"-p{password}"

Expand Down Expand Up @@ -967,3 +968,25 @@ def msix_extract(file: str, *, data_dictionary: dict, **_) -> ExtractorReturnTyp
ctx["extracted_files"] = collect_extracted_filenames(tempdir)

return ctx



@time_tracker
def UnGPG_extract(file: str, filetype: str, data_dictionary: dict, options: dict, **_) -> ExtractorReturnType:

if "PGP symmetric key encrypted data" not in data_dictionary.get("type", ""):
return

password = options.get("password", "infected")
filename = os.path.basename(file)
with extractor_ctx(file, "UnGPG", prefix="unpgp", folder=tools_folder) as ctx:
tempdir = ctx["tempdir"]
output = run_tool(
["gpg", "--passphrase", password, "--batch", "--quiet", "--yes", "-o", os.path.join(tempdir, filename), "-d", file],
universal_newlines=True,
stderr=subprocess.PIPE,
)
if output:
ctx["extracted_files"] = collect_extracted_filenames(tempdir)

return ctx
2 changes: 1 addition & 1 deletion modules/processing/CAPE.py
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@
from lib.cuckoo.common.integrations.file_extra_info import DuplicatesType, static_file_info
from lib.cuckoo.common.objects import File
from lib.cuckoo.common.path_utils import path_exists
from lib.cuckoo.common.replace_patterns_utils import _clean_path
from lib.cuckoo.common.replace_patterns_utils import _clean_path, check_deny_pattern
from lib.cuckoo.common.utils import (
add_family_detection,
convert_to_printable_and_truncate,
Expand Down
8 changes: 6 additions & 2 deletions utils/process.py
Original file line number Diff line number Diff line change
Expand Up @@ -286,10 +286,14 @@ def processing_finished(future):
_ = future.result()
log.info("Reports generation completed for Task #%d", task_id)
except TimeoutError as error:
log.error("[%d] Processing Timeout %s. Function: %s", task_id, error, error.args[1])
exc_clsname = error.__class__.__name__
exc_message = str(error) or "unknown error"
log.error("[%d] Processing Timeout %s. Function: %s - %s", task_id, exc_message, error.args[1], exc_clsname)
Database().set_status(task_id, TASK_FAILED_PROCESSING)
except pebble.ProcessExpired as error:
log.error("[%d] Exception when processing task: %s", task_id, error, exc_info=True)
exc_clsname = error.__class__.__name__
exc_message = str(error) or "unknown error"
log.error("[%d] Exception when processing task: %s - %s", task_id, exc_message, exc_clsname, exc_info=True)
Database().set_status(task_id, TASK_FAILED_PROCESSING)
except Exception as error:
log.error("[%d] Exception when processing task: %s", task_id, error, exc_info=True)
Expand Down

0 comments on commit 1556340

Please sign in to comment.