Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 20 additions & 34 deletions modules/processing/CAPE.py
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ def _metadata_processing(self, metadata, file_info, append_file):
file_info["module_path"] = _clean_path(metastrings[2], self.options.replace_patterns)

if "pids" in metadata:
file_info["pid"] = metadata["pids"][0] if len(metadata["pids"]) == 1 else ",".join(metadata["pids"])
file_info["pid"] = metadata["pids"][0] if len(metadata["pids"]) == 1 else ",".join(str(p) for p in metadata["pids"])

if metastrings and metastrings[0] and metastrings[0].isdigit():
file_info["cape_type_code"] = int(metastrings[0])
Expand Down Expand Up @@ -204,45 +204,29 @@ def process_file(self, file_path, append_file, metadata: dict, *, category: str,

yara_match = db_file.get("yara_hash", "") == File.yara_rules_hash
options_match = db_file.get("options_hash", "") == options_hash

file_info = db_file
cached = True
if yara_match and options_match:
file_info = db_file
cached = True
run_static = False
# Regenerate fields stripped by mongo_hooks
if "type" not in file_info:
file_info["type"] = f.get_type()

if processing_conf.CAPE.pefile_store:
# Populate internal pe object for self.results["pefiles"]
f.get_type()
pefile_object = f.pe
else:
# Partial hit
file_info = db_file
cached = True # We have the base object
run_static = True # But we need to re-run static/tools

# Regenerate fields stripped by mongo_hooks
if "type" not in file_info:
file_info["type"] = f.get_type()

if processing_conf.CAPE.pefile_store:
# Populate internal pe object for self.results["pefiles"]
f.get_type()
pefile_object = f.pe
# We need to re-run static/tools
run_static = True

if "options_hash" not in file_info:
file_info["options_hash"] = options_hash
if not yara_match:
# Update YARA
file_info["yara"] = f.get_yara()
file_info["cape_yara"] = f.get_yara(category="CAPE")
file_info["yara_hash"] = File.yara_rules_hash

if "yara_hash" not in file_info:
file_info["yara_hash"] = File.yara_rules_hash
if "options_hash" not in file_info:
file_info["options_hash"] = options_hash
if "yara_hash" not in file_info:
file_info["yara_hash"] = File.yara_rules_hash

if not yara_match:
# Update YARA
file_info["yara"] = f.get_yara()
file_info["cape_yara"] = f.get_yara(category="CAPE")
file_info["yara_hash"] = File.yara_rules_hash
if processing_conf.CAPE.pefile_store:
# Populate internal pe object for self.results["pefiles"]
f.get_type()
pefile_object = f.pe

except Exception as e:
log.exception(e)
Expand All @@ -252,6 +236,8 @@ def process_file(self, file_path, append_file, metadata: dict, *, category: str,
file_info["yara_hash"] = File.yara_rules_hash
run_static = True

if "type" not in file_info:
file_info["type"] = f.get_type()
if "name" not in file_info:
file_info["name"] = f.get_name()
if "guest_paths" not in file_info:
Expand Down
8 changes: 5 additions & 3 deletions web/templates/analysis/overview/_info.html
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,11 @@ <h5 class="d-inline-block me-2 font-weight-bold">Status:</h5>
<div class="card-header border-secondary d-flex justify-content-between align-items-center">
<h5 class="mb-0 text-white"><i class="fas fa-info-circle me-2 text-info"></i> Analysis Details</h5>
{% if settings.REPROCESS_TASKS %}
<a class="btn btn-sm btn-outline-secondary" href="{% url "reprocess_tasks" id %}" role="button" data-bs-toggle="tooltip" title="Reprocess Task">
<i class="fas fa-redo"></i>
</a>
<div>
<a class="btn btn-sm btn-secondary" href="{% url "reprocess_tasks" id %}" role="button" data-bs-toggle="tooltip" title="Reprocess Task">
<i class="fas fa-redo"></i>
</a>
</div>
{% endif %}
</div>
<div class="table-responsive">
Expand Down
Loading