diff --git a/analyzers/FileInfo/fileinfo_analyzer.py b/analyzers/FileInfo/fileinfo_analyzer.py index a0b023a5e..1059f8874 100755 --- a/analyzers/FileInfo/fileinfo_analyzer.py +++ b/analyzers/FileInfo/fileinfo_analyzer.py @@ -16,8 +16,9 @@ def __init__(self): self.mimetype = magic.Magic(mime=True).from_file(self.filepath) - def build_summary(self, summary, module_results): + def build_summary(self, module_results): + summary = [] for m in module_results: if m["submodule_section_summary"]["taxonomies"] != []: @@ -34,9 +35,11 @@ def run(self): matadata_results = m.analyze_file(self.filepath) results.append({ 'submodule_name': m.name, - 'results': matadata_results + 'results': matadata_results, + 'summary': self.build_summary(matadata_results) + }) - self.build_summary(summary, matadata_results) + # self.build_summary(summary, matadata_results) for module in available_submodules: if module.check_file(file=self.filepath, filetype=self.filetype, filename=self.filename, @@ -44,10 +47,11 @@ def run(self): module_results = module.analyze_file(self.filepath) results.append({ 'submodule_name': module.name, - 'results': module_results + 'results': module_results, + 'summary': self.build_summary(module_results) }) - self.build_summary(summary, module_results) + # self.build_summary(summary, module_results) self.report({'results': results, 'summary': summary}) diff --git a/analyzers/FileInfo/submodules/submodule_base.py b/analyzers/FileInfo/submodules/submodule_base.py index 4aa1c69dd..5d363d07d 100644 --- a/analyzers/FileInfo/submodules/submodule_base.py +++ b/analyzers/FileInfo/submodules/submodule_base.py @@ -56,6 +56,8 @@ def analyze_file(self, path): """ pass + def section_summary(self, report): + def add_result_subsection(self, subsection_header, results, summary={"taxonomies": []}): """ Adding a subsection to the section of the analyzer module diff --git a/analyzers/FileInfo/submodules/submodule_oletools.py b/analyzers/FileInfo/submodules/submodule_oletools.py index eee2eaf5c..3472e9fb0 100644 --- a/analyzers/FileInfo/submodules/submodule_oletools.py +++ b/analyzers/FileInfo/submodules/submodule_oletools.py @@ -2,6 +2,9 @@ from .submodule_base import SubmoduleBaseclass from oletools.olevba3 import VBA_Parser_CLI from oletools.msodde import process_file +from oletools.olevba3 import __version__ as olevba_version +from oletools.msodde import __version__ as msodde_version + class OLEToolsSubmodule(SubmoduleBaseclass): @@ -43,7 +46,9 @@ def analyze_file(self, path): def olevba_summary(self, analysis): """ Build summary for Olevba part of the submodule""" - summary = {'taxonomies': []} + version = {'Olevba version': olevba_version} + summary = {'taxonomies': [], + 'version': [version]} type_list = [] @@ -68,6 +73,9 @@ def olevba_summary(self, analysis): def analyze_vba(self, path): """Analyze a given sample for malicious vba.""" + + + try: vba_parser = VBA_Parser_CLI(path, relaxed=True) @@ -77,6 +85,7 @@ def analyze_vba(self, path): vba_code_only=False, show_deobfuscated_code=True, deobfuscate=True) + self.add_result_subsection('Olevba', vbaparser_result, self.olevba_summary(vbaparser_result["analysis"])) except TypeError: self.add_result_subsection('Oletools VBA Analysis failed', 'Analysis failed due to an filetype error.' @@ -84,10 +93,15 @@ def analyze_vba(self, path): 'file.') def analyze_dde(self, path): + version = {'Msodde version': msodde_version} + summary = {'taxonomies':[], + 'version': [version]} results = process_file(path) if len(results) > 0: - self.add_result_subsection('Oletools DDE Analysis', {'DDEUrl': results}, {"DDE": True}) + summary["taxonomies"].append(self.build_taxonomy('suspicious', 'FileInfo', 'DDE', 'URL found')) + self.add_result_subsection('Oletools DDE Analysis', {'DDEUrl': results}, summary) else: - self.add_result_subsection('Oletools DDE Analysis', {'Info': 'No DDE URLs found.'}) + summary["taxonomies"].append(self.build_taxonomy('info', 'FileInfo', 'DDE', 'Not found')) + self.add_result_subsection('Oletools DDE Analysis', {'Info': 'No DDE URLs found.'}, summary) diff --git a/thehive-templates/FileInfo_3_0/long.html b/thehive-templates/FileInfo_3_0/long.html index 635f19d9b..a5953bcf4 100644 --- a/thehive-templates/FileInfo_3_0/long.html +++ b/thehive-templates/FileInfo_3_0/long.html @@ -6,6 +6,9 @@ + +
+
@@ -30,7 +33,41 @@

+ +
+ + +
+
+
+

Summary

+
+
+
+
Olevba version
+
{{result.summary["Olevba version"]}}
+
+
+
Msodde version
+
{{result.summary["Msodde version"]}}
+
+ + +
+
Oletools scanner
+
+ + {{t.namespace}}:{{t.predicate}}={{t.value}} + +
+
+ +
+ +
+
+