CAPE-parsers 0.1.60__tar.gz → 0.1.61__tar.gz

{cape_parsers-0.1.60 → cape_parsers-0.1.61}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: CAPE-parsers
-Version: 0.1.60
+Version: 0.1.61
 Summary: CAPE: Malware Configuration Extraction
 License: MIT
 License-File: LICENSE

{cape_parsers-0.1.60 → cape_parsers-0.1.61}/cape_parsers/CAPE/core/AuraStealer.py

@@ -40,14 +40,16 @@ def decrypt(data: bytes) -> Tuple[bytes, bytes, bytes]:
 def extract_config(data: bytes) -> Dict[str, Any]:
     cfg: Dict[str, Any] = {}
     plaintext = b""
+    data_section = None
 
     pe = pefile.PE(data=data, fast_load=True)
-    try:
-        data_section = [s for s in pe.sections if s.Name.find(b".data") != -1][0]
-    except IndexError:
-        return cfg
+    for s in pe.sections:
+        name = s.Name.decode("utf-8", errors="ignore").rstrip("\x00")
+        if name in ("UPX1", ".data"):
+            data_section = s
+            break
 
-    if not data_section:
+    if data_section is None:
         return cfg
 
     data = data_section.get_data()

{cape_parsers-0.1.60 → cape_parsers-0.1.61}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "CAPE-parsers"
-version = "0.1.60"
+version = "0.1.61"
 description = "CAPE: Malware Configuration Extraction"
 authors = ["Kevin O'Reilly <kev@capesandbox.com>", "doomedraven <doomedraven@capesandbox.com>"]
 license = "MIT"