CAPE-parsers 0.1.60__py3-none-any.whl → 0.1.61__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. cape_parsers/CAPE/core/AuraStealer.py +7 -5
  2. {cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/METADATA +1 -1
  3. {cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/RECORD +5 -5
  4. {cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/WHEEL +0 -0
  5. {cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/licenses/LICENSE +0 -0
cape_parsers/CAPE/core/AuraStealer.py CHANGED
@@ -40,14 +40,16 @@ def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
40
40
  def extract_config(data: bytes) -> Dict[str, Any]:
41
41
  cfg: Dict[str, Any] = {}
42
42
  plaintext = b""
43
+ data_section = None
43
44
 
44
45
  pe = pefile.PE(data=data, fast_load=True)
45
- try:
46
- data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
47
- except IndexError:
48
- return cfg
46
+ for s in pe.sections:
47
+ name = s.Name.decode("utf-8", errors="ignore").rstrip("\x00")
48
+ if name in ("UPX1", ".data"):
49
+ data_section = s
50
+ break
49
51
 
50
- if not data_section:
52
+ if data_section is None:
51
53
  return cfg
52
54
 
53
55
  data = data_section.get_data()
{cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: CAPE-parsers
3
- Version: 0.1.60
3
+ Version: 0.1.61
4
4
  Summary: CAPE: Malware Configuration Extraction
5
5
  License: MIT
6
6
  License-File: LICENSE
{cape_parsers-0.1.60.dist-info → cape_parsers-0.1.61.dist-info}/RECORD RENAMED
@@ -30,7 +30,7 @@ cape_parsers/CAPE/community/XWorm.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_
30
30
  cape_parsers/CAPE/community/XenoRAT.py,sha256=0-FRT3d2x63KQ_cs1xmKFj7x0JRf7ID6QDc_DvBa0PM,1003
31
31
  cape_parsers/CAPE/community/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
32
32
  cape_parsers/CAPE/core/AdaptixBeacon.py,sha256=j1PN5yYQG9smdzU8lHtIy7wXYZRYPC2doegwNuTb7E4,3462
33
- cape_parsers/CAPE/core/AuraStealer.py,sha256=RSiclflsvcrcNLHpRokc_qF2cdQKXGBKg8Ti-Q-XmaM,3021
33
+ cape_parsers/CAPE/core/AuraStealer.py,sha256=t1HBlQuoC1Lud648L12PujUE6S0th8bLVywvvfEkDNQ,3097
34
34
  cape_parsers/CAPE/core/Azorult.py,sha256=YkMIhC6zRTxEkLVMUdr2MMsbV9iAnZ8hUS8be9GZ5N4,2150
35
35
  cape_parsers/CAPE/core/BitPaymer.py,sha256=HQwoE0o7HMiXItxE08vBenf2ZWMxZp84-Hf_1eZ8QdE,3050
36
36
  cape_parsers/CAPE/core/BlackDropper.py,sha256=sCSu2T5oPvcFHlSAzSsLj_gCv2Tldl0UPguwy0MVg6A,3282
@@ -112,7 +112,7 @@ cape_parsers/utils/blzpack_lib.so,sha256=5PJtnggw8fV5q4DlhwMJk4ZadvC3fFTsVTNZKvE
112
112
  cape_parsers/utils/dotnet_utils.py,sha256=pzQGbCqccz7DRv8T_i1JURlrKDIlDT2axxViiFF9hsU,1672
113
113
  cape_parsers/utils/lznt1.py,sha256=X-BmJtP6AwYSl0ORg5dfSt-NIuXbHrtCO5kUaaJI2C8,4066
114
114
  cape_parsers/utils/strings.py,sha256=a-nbvP9jYST7b6t_H37Ype-fK2jEmQr-wMF5a4i04e4,3062
115
- cape_parsers-0.1.60.dist-info/METADATA,sha256=uC0gVg_hKpZuVrHSLzKie3I0QsGgFOahOkC-TOk8BMQ,1826
116
- cape_parsers-0.1.60.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
117
- cape_parsers-0.1.60.dist-info/licenses/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
118
- cape_parsers-0.1.60.dist-info/RECORD,,
115
+ cape_parsers-0.1.61.dist-info/METADATA,sha256=b5-fy-23Df12UchoLK2vRS3hAusCPLYcPTy9FC3WRj0,1826
116
+ cape_parsers-0.1.61.dist-info/WHEEL,sha256=zp0Cn7JsFoX2ATtOhtaFYIiE2rmFAD4OcMhtUki8W3U,88
117
+ cape_parsers-0.1.61.dist-info/licenses/LICENSE,sha256=88c01_HLG8WPj7R7aU_b-O-UoF38vrrifvcko4KDxcE,1069
118
+ cape_parsers-0.1.61.dist-info/RECORD,,