Skip to content

Commit

Permalink
Update VirustotalDownloader.py
Browse files Browse the repository at this point in the history
Fixed copy/paste error and suggestion from TheHive-Project/Cortex-Analyzers#766 (comment)
  • Loading branch information
NexusFuzzy authored Jun 12, 2020
1 parent ef15c94 commit 0c63d05
Showing 1 changed file with 7 additions and 3 deletions.
10 changes: 7 additions & 3 deletions VirustotalDownloader.py
Original file line number Diff line number Diff line change
Expand Up @@ -43,25 +43,29 @@ def run(self):

kind = filetype.guess(f.name)

if kind.extension != None:
if kind:
os.rename(f.name, f.name + "." + kind.extension)
filename = f.name + "." + kind.extension
tags = ['src:VirusTotal', str(kind.mime), str(kind.extension), 'parent:' + self.get_param('data.data')]
else:
filename = f.name
tags = ['src:VirusTotal', 'parent:' + self.get_param('data.data')]

api = TheHiveApi(self.thehive_url, self.thehive_apikey)

file_observable = CaseObservable(dataType='file',
data=[filename],
tlp=self.get_param('data.tlp'),
ioc=True,
tags=['src:VirusTotal', str(kind.mime), str(kind.extension), 'parent:' + self.get_param('data.data')],
tags=tags
message=''
)

response = api.create_case_observable(case_id, file_observable)

self.report({'message': str(response.status_code)})
else:
self.report({'message': 'Virustotal returned the following error code: ' + str(response.status_code) + ". If you receive 403 this means that $
self.report({'message': 'Virustotal returned the following error code: ' + str(response.status_code) + ". If you receive 403 this means that you are using the free API instead of the premium API."})
else:
self.error('Incorrect dataType. "Hash" expected.')

Expand Down

0 comments on commit 0c63d05

Please sign in to comment.