diff --git a/modules/processing/CAPE.py b/modules/processing/CAPE.py index cbd6e2dd99e..ebe5210c17a 100644 --- a/modules/processing/CAPE.py +++ b/modules/processing/CAPE.py @@ -133,7 +133,7 @@ def _metadata_processing(self, metadata, file_info, append_file): file_info["module_path"] = _clean_path(metastrings[2], self.options.replace_patterns) if "pids" in metadata: - file_info["pid"] = metadata["pids"][0] if len(metadata["pids"]) == 1 else ",".join(metadata["pids"]) + file_info["pid"] = metadata["pids"][0] if len(metadata["pids"]) == 1 else ",".join(str(p) for p in metadata["pids"]) if metastrings and metastrings[0] and metastrings[0].isdigit(): file_info["cape_type_code"] = int(metastrings[0]) @@ -204,45 +204,29 @@ def process_file(self, file_path, append_file, metadata: dict, *, category: str, yara_match = db_file.get("yara_hash", "") == File.yara_rules_hash options_match = db_file.get("options_hash", "") == options_hash - + file_info = db_file + cached = True if yara_match and options_match: - file_info = db_file - cached = True run_static = False - # Regenerate fields stripped by mongo_hooks - if "type" not in file_info: - file_info["type"] = f.get_type() - - if processing_conf.CAPE.pefile_store: - # Populate internal pe object for self.results["pefiles"] - f.get_type() - pefile_object = f.pe else: - # Partial hit - file_info = db_file - cached = True # We have the base object - run_static = True # But we need to re-run static/tools - - # Regenerate fields stripped by mongo_hooks - if "type" not in file_info: - file_info["type"] = f.get_type() - - if processing_conf.CAPE.pefile_store: - # Populate internal pe object for self.results["pefiles"] - f.get_type() - pefile_object = f.pe + # We need to re-run static/tools + run_static = True - if "options_hash" not in file_info: - file_info["options_hash"] = options_hash + if not yara_match: + # Update YARA + file_info["yara"] = f.get_yara() + file_info["cape_yara"] = f.get_yara(category="CAPE") + file_info["yara_hash"] = File.yara_rules_hash - if "yara_hash" not in file_info: - file_info["yara_hash"] = File.yara_rules_hash + if "options_hash" not in file_info: + file_info["options_hash"] = options_hash + if "yara_hash" not in file_info: + file_info["yara_hash"] = File.yara_rules_hash - if not yara_match: - # Update YARA - file_info["yara"] = f.get_yara() - file_info["cape_yara"] = f.get_yara(category="CAPE") - file_info["yara_hash"] = File.yara_rules_hash + if processing_conf.CAPE.pefile_store: + # Populate internal pe object for self.results["pefiles"] + f.get_type() + pefile_object = f.pe except Exception as e: log.exception(e) @@ -252,6 +236,8 @@ def process_file(self, file_path, append_file, metadata: dict, *, category: str, file_info["yara_hash"] = File.yara_rules_hash run_static = True + if "type" not in file_info: + file_info["type"] = f.get_type() if "name" not in file_info: file_info["name"] = f.get_name() if "guest_paths" not in file_info: diff --git a/web/templates/analysis/overview/_info.html b/web/templates/analysis/overview/_info.html index 8e226fca82c..e96c2dc2719 100644 --- a/web/templates/analysis/overview/_info.html +++ b/web/templates/analysis/overview/_info.html @@ -33,9 +33,11 @@