Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] FileInfo_7_0 error if msg has encrypted zip attachment #924

Closed
nielszcert opened this issue Jan 12, 2021 · 1 comment
Closed

[Bug] FileInfo_7_0 error if msg has encrypted zip attachment #924

nielszcert opened this issue Jan 12, 2021 · 1 comment

Comments

@nielszcert
Copy link

Describe the bug
When a msg file contains a attachment that is a encrypted it breaks.

To Reproduce
Steps to reproduce the behavior:

  1. attach a zip file with a password to an email and save that email as msg
  2. upload msg in TheHive
  3. scan with FileInfo_7_0

Expected behavior
The application should just say that the zip is encrypted instead of crashing.

Complementary information
Traceback (most recent call last): File "/Cortex-Analyzers/analyzers/FileInfo/fileinfo_analyzer.py", line 76, in <module> FileInfoAnalyzer().run() File "/Cortex-Analyzers/analyzers/FileInfo/fileinfo_analyzer.py", line 64, in run module_results = module.analyze_file(self.filepath) File "/Cortex-Analyzers/analyzers/FileInfo/submodules/submodule_oletools.py", line 64, in analyze_file self.analyze_vba(path) File "/Cortex-Analyzers/analyzers/FileInfo/submodules/submodule_oletools.py", line 128, in analyze_vba path = decrypt(path) File "/usr/local/lib/python3.7/dist-packages/oletools/crypto.py", line 380, in decrypt exec('raise UnsupportedEncryptionError(filename) from None') File "<string>", line 1, in <module>oletools.common.errors.UnsupportedEncryptionError: Office file /tmp/cortex-job-VNuI4XYBJz5T0REiygnt-4775860985038091071/input/attachment12357675004074500511 is encrypted, not yet supported

Work environment

  • Cortex Analyzer/Responder name: FileInfo
  • Cortex Analyzer/Responder version: 7

Possible solutions
By adding a simple try: statement on line 64 of fileinfo_analyzer.py the error doesn't crash the analyzer anymore

@garanews
Copy link
Contributor

garanews commented Mar 9, 2021

fixed with #915

@garanews garanews closed this as completed Mar 9, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants