Skip to content

Commit

Permalink
PEP8, removed some unused imports and variables
Browse files Browse the repository at this point in the history
  • Loading branch information
3c7 committed May 16, 2018
1 parent c5ed8cc commit 34dffbc
Show file tree
Hide file tree
Showing 5 changed files with 15 additions and 23 deletions.
2 changes: 1 addition & 1 deletion analyzers/FileInfo/submodules/submodule_gzip.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,4 +15,4 @@ def check_file(self, **kwargs):

def analyze_file(self, path):
self.add_result_subsection('TEST', {})
return self.results
return self.results
17 changes: 3 additions & 14 deletions analyzers/FileInfo/submodules/submodule_oletools.py
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
"""FileInfo oletools submodule; WIP"""
from .submodule_base import SubmoduleBaseclass
from oletools.oleid import OleID
from oletools.olevba3 import VBA_Parser_CLI
from oletools.olevba3 import VBA_Parser_CLI
from oletools.msodde import process_file


Expand Down Expand Up @@ -34,22 +33,11 @@ def check_file(self, **kwargs):

def analyze_file(self, path):
# Run the analyze functions
#self.analyze_oleid(path)
self.analyze_vba(path)
self.analyze_dde(path)

return self.results

# def analyze_oleid(self, path):
# indicators = OleID(path).check()
# results = {}
#
# for indicator in indicators:
# if indicator.id == 'appname':
# continue
# results.update({indicator.name: indicator.value})
# self.add_result_subsection('Oletools OleID Results', results)

def analyze_vba(self, path):
"""Analyze a given sample for malicios vba."""
try:
Expand All @@ -64,7 +52,8 @@ def analyze_vba(self, path):
self.add_result_subsection('Olevba', vbaparser_result)
except TypeError:
self.add_result_subsection('Oletools VBA Analysis failed', 'Analysis failed due to an filetype error.'
'The file does not seem to be a valid MS-Office file.')
'The file does not seem to be a valid MS-Office '
'file.')

def analyze_dde(self, path):
results = process_file(path)
Expand Down
2 changes: 2 additions & 0 deletions analyzers/FileInfo/submodules/submodule_outlook.py
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
import hashlib
from .submodule_base import SubmoduleBaseclass

from ExtractMsg import Message, Attachment
from imapclient.imapclient import decode_utf7


class OutlookSubmodule(SubmoduleBaseclass):
"""Parse Outlook Mail and get useful information"""

Expand Down
3 changes: 2 additions & 1 deletion analyzers/FileInfo/submodules/submodule_pdfid.py
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@

from .submodule_base import SubmoduleBaseclass


class PDFIDSubmodule(SubmoduleBaseclass):
def __init__(self):
SubmoduleBaseclass.__init__(self)
Expand All @@ -27,4 +28,4 @@ def pdfid_cmd(self, path):

def analyze_file(self, path):
self.add_result_subsection('PDFiD Information', self.pdfid_cmd(path))
return self.results
return self.results
14 changes: 7 additions & 7 deletions analyzers/FileInfo/submodules/submodule_pe.py
Original file line number Diff line number Diff line change
Expand Up @@ -66,11 +66,13 @@ def pe_info(self, pe):

@staticmethod
def pe_iat(pe):
table = []
if pe:
table = []
for entry in pe.DIRECTORY_ENTRY_IMPORT:
imp = {'entryname': '', 'symbols': []}
imp['entryname'] = entry.dll.decode()
imp = {
'entryname': entry.dll.decode(),
'symbols': []
}
for symbol in entry.imports:
if symbol.name is not None:
imp['symbols'].append(symbol.name.decode())
Expand All @@ -80,8 +82,8 @@ def pe_iat(pe):
# PE:Sections list of {Name, Size, Entropy, MD5, SHA1, SHA256, SHA512} #
@staticmethod
def pe_sections(pe):
table = []
if pe:
table = []
for entry in pe.sections:
sect = {'entryname': str(entry.Name.decode()), 'SizeOfRawData': hex(entry.SizeOfRawData),
'Entropy': entry.get_entropy(),
Expand All @@ -90,14 +92,12 @@ def pe_sections(pe):
'SHA256': entry.get_hash_sha256(),
'SHA512': entry.get_hash_sha512()}
table.append(sect)
sect = {}
return table

def analyze_file(self, path):
try:
pe = pefile.PE(path)
pedict = pe.dump_dict()
except Exception as excp:
except Exception:
return "Failed processing {}".format(path)

self.add_result_subsection('Headers', self.pe_info(pe))
Expand Down

0 comments on commit 34dffbc

Please sign in to comment.