diff --git a/analyzers/FileInfo/fileinfo_analyzer.py b/analyzers/FileInfo/fileinfo_analyzer.py
index a0b023a5e..1059f8874 100755
--- a/analyzers/FileInfo/fileinfo_analyzer.py
+++ b/analyzers/FileInfo/fileinfo_analyzer.py
@@ -16,8 +16,9 @@ def __init__(self):
self.mimetype = magic.Magic(mime=True).from_file(self.filepath)
- def build_summary(self, summary, module_results):
+ def build_summary(self, module_results):
+ summary = []
for m in module_results:
if m["submodule_section_summary"]["taxonomies"] != []:
@@ -34,9 +35,11 @@ def run(self):
matadata_results = m.analyze_file(self.filepath)
results.append({
'submodule_name': m.name,
- 'results': matadata_results
+ 'results': matadata_results,
+ 'summary': self.build_summary(matadata_results)
+
})
- self.build_summary(summary, matadata_results)
+ # self.build_summary(summary, matadata_results)
for module in available_submodules:
if module.check_file(file=self.filepath, filetype=self.filetype, filename=self.filename,
@@ -44,10 +47,11 @@ def run(self):
module_results = module.analyze_file(self.filepath)
results.append({
'submodule_name': module.name,
- 'results': module_results
+ 'results': module_results,
+ 'summary': self.build_summary(module_results)
})
- self.build_summary(summary, module_results)
+ # self.build_summary(summary, module_results)
self.report({'results': results, 'summary': summary})
diff --git a/analyzers/FileInfo/submodules/submodule_base.py b/analyzers/FileInfo/submodules/submodule_base.py
index 4aa1c69dd..5d363d07d 100644
--- a/analyzers/FileInfo/submodules/submodule_base.py
+++ b/analyzers/FileInfo/submodules/submodule_base.py
@@ -56,6 +56,8 @@ def analyze_file(self, path):
"""
pass
+ def section_summary(self, report):
+
def add_result_subsection(self, subsection_header, results, summary={"taxonomies": []}):
"""
Adding a subsection to the section of the analyzer module
diff --git a/analyzers/FileInfo/submodules/submodule_oletools.py b/analyzers/FileInfo/submodules/submodule_oletools.py
index eee2eaf5c..3472e9fb0 100644
--- a/analyzers/FileInfo/submodules/submodule_oletools.py
+++ b/analyzers/FileInfo/submodules/submodule_oletools.py
@@ -2,6 +2,9 @@
from .submodule_base import SubmoduleBaseclass
from oletools.olevba3 import VBA_Parser_CLI
from oletools.msodde import process_file
+from oletools.olevba3 import __version__ as olevba_version
+from oletools.msodde import __version__ as msodde_version
+
class OLEToolsSubmodule(SubmoduleBaseclass):
@@ -43,7 +46,9 @@ def analyze_file(self, path):
def olevba_summary(self, analysis):
""" Build summary for Olevba part of the submodule"""
- summary = {'taxonomies': []}
+ version = {'Olevba version': olevba_version}
+ summary = {'taxonomies': [],
+ 'version': [version]}
type_list = []
@@ -68,6 +73,9 @@ def olevba_summary(self, analysis):
def analyze_vba(self, path):
"""Analyze a given sample for malicious vba."""
+
+
+
try:
vba_parser = VBA_Parser_CLI(path, relaxed=True)
@@ -77,6 +85,7 @@ def analyze_vba(self, path):
vba_code_only=False,
show_deobfuscated_code=True,
deobfuscate=True)
+
self.add_result_subsection('Olevba', vbaparser_result, self.olevba_summary(vbaparser_result["analysis"]))
except TypeError:
self.add_result_subsection('Oletools VBA Analysis failed', 'Analysis failed due to an filetype error.'
@@ -84,10 +93,15 @@ def analyze_vba(self, path):
'file.')
def analyze_dde(self, path):
+ version = {'Msodde version': msodde_version}
+ summary = {'taxonomies':[],
+ 'version': [version]}
results = process_file(path)
if len(results) > 0:
- self.add_result_subsection('Oletools DDE Analysis', {'DDEUrl': results}, {"DDE": True})
+ summary["taxonomies"].append(self.build_taxonomy('suspicious', 'FileInfo', 'DDE', 'URL found'))
+ self.add_result_subsection('Oletools DDE Analysis', {'DDEUrl': results}, summary)
else:
- self.add_result_subsection('Oletools DDE Analysis', {'Info': 'No DDE URLs found.'})
+ summary["taxonomies"].append(self.build_taxonomy('info', 'FileInfo', 'DDE', 'Not found'))
+ self.add_result_subsection('Oletools DDE Analysis', {'Info': 'No DDE URLs found.'}, summary)
diff --git a/thehive-templates/FileInfo_3_0/long.html b/thehive-templates/FileInfo_3_0/long.html
index 635f19d9b..a5953bcf4 100644
--- a/thehive-templates/FileInfo_3_0/long.html
+++ b/thehive-templates/FileInfo_3_0/long.html
@@ -6,6 +6,9 @@
+
+
+
@@ -30,7 +33,41 @@
+
+
+
+
+
+
+
+
Summary
+
+
+
+ - Olevba version
+ - {{result.summary["Olevba version"]}}
+
+
+ - Msodde version
+ - {{result.summary["Msodde version"]}}
+
+
+
+
+ - Oletools scanner
+ -
+
+ {{t.namespace}}:{{t.predicate}}={{t.value}}
+
+
+
+
+
+
+
+
+