assemblyline-v4-service 4.6.1.dev126__py3-none-any.whl → 4.6.1.dev128__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of assemblyline-v4-service might be problematic. Click here for more details.

Files changed (9) hide show
  1. assemblyline_v4_service/VERSION +1 -1
  2. assemblyline_v4_service/common/ocr.py +70 -97
  3. assemblyline_v4_service/common/utils.py +1 -1
  4. {assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/METADATA +1 -1
  5. {assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/RECORD +9 -9
  6. test/test_common/test_ocr.py +1 -1
  7. {assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/WHEEL +0 -0
  8. {assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/licenses/LICENCE.md +0 -0
  9. {assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/top_level.txt +0 -0
assemblyline_v4_service/VERSION CHANGED
@@ -1 +1 @@
1
- 4.6.1.dev126
1
+ 4.6.1.dev128
assemblyline_v4_service/common/ocr.py CHANGED
@@ -8,103 +8,76 @@ from assemblyline_v4_service.common.utils import PASSWORD_WORDS
8
8
  # The terms related to each indicator category
9
9
  OCR_INDICATORS_TERMS: dict[str, list[str]] = {
10
10
  "ransomware": [
11
- # https://github.com/cuckoosandbox/community/blob/master/modules/signatures/windows/ransomware_message.py
12
- "AES 128",
13
- "AES 256",
14
- "AES-128",
15
- "AES-256",
16
- "AES128",
17
- "AES256",
18
- "RSA 1024",
19
- "RSA 2048",
20
- "RSA 4096",
21
- "RSA-1024",
22
- "RSA-2048",
23
- "RSA-4096",
24
- "RSA1024",
25
- "RSA2048",
26
- "RSA4096",
27
- "bitcoin",
28
- "bootkit",
29
- "decrypt",
30
- "download tor",
31
- "encrypt",
32
- "enter code",
33
- "has been locked",
34
- "install tor",
35
- "pay a fine",
36
- "pay fine",
37
- "pay the fine",
38
- "payment",
39
- "personal code",
40
- "personal key",
41
- "private code",
42
- "private key",
43
- "ransom",
44
- "recover data",
45
- "recover data",
46
- "recover files",
47
- "recover files",
48
- "recover personal",
49
- "recover the data",
50
- "recover the files",
51
- "recover them",
52
- "recover your",
53
- "restore data",
54
- "restore files",
55
- "restore the data",
56
- "restore the files",
57
- "rootkit",
58
- "secret internet server",
59
- "secret server",
60
- "tor browser",
61
- "tor gateway",
62
- "tor-browser",
63
- "tor-gateway",
64
- "torbrowser",
65
- "torgateway",
66
- "torproject.org",
67
- "unique key",
68
- "victim",
69
- "your code",
70
- "your data",
71
- "your documents",
72
- "your files",
73
- "your key",
74
- # https://github.com/CAPESandbox/community/blob/815e21980f4b234cf84e78749447f262af2beef9/modules/signatures/office_macro.py
75
- "bank account",
76
- # https://github.com/CAPESandbox/community/blob/815e21980f4b234cf84e78749447f262af2beef9/modules/signatures/ransomware_message.py
77
- "Attention!",
78
- "BTC",
79
- "HardwareID",
80
- "bit coin",
81
- "decrypter",
82
- "decryptor",
83
- "device ID",
84
- "encrypted",
85
- "encryption ID",
86
- "ethereum",
87
- "get back my",
88
- "get back your",
89
- "localbitcoins",
90
- "military grade encryption",
91
- "personal ID",
92
- "personal identification code",
93
- "personal identifier",
94
- "recover datarecover the files",
95
- "recover my",
96
- "restore system",
97
- "restore the system",
98
- "unique ID",
99
- "wallet address",
100
- "what happend",
101
- "what happened",
102
- "your database",
103
- "your network",
104
- # Other
105
- "coin",
106
- "ether",
107
- "litecoin",
11
+ "tor browser",
12
+ "torproject org",
13
+ "www torproject",
14
+ "www torproject org",
15
+ "https www torproject",
16
+ "https www torproject org",
17
+ "install tor",
18
+ "install tor browser",
19
+ "tor browser https",
20
+ "files encrypted",
21
+ "download install tor",
22
+ "download install tor browser",
23
+ "browser https www torproject",
24
+ "decrypt files",
25
+ "tor browser https www",
26
+ "private key",
27
+ "id snip",
28
+ "download tor",
29
+ "onion http",
30
+ "install tor browser https",
31
+ "https torproject",
32
+ "https torproject org",
33
+ "onion snip",
34
+ "torproject org download",
35
+ "www torproject org download",
36
+ "download tor browser",
37
+ "restore files",
38
+ "recover files",
39
+ "decryption software",
40
+ "pay ransom",
41
+ "decryption tool",
42
+ "data loss",
43
+ "tor browser open",
44
+ "data encrypted",
45
+ "important files",
46
+ "data stolen",
47
+ "damage files",
48
+ "decrypt file",
49
+ "tor browser http",
50
+ "leaked data",
51
+ "recover data",
52
+ "tor browser site",
53
+ "using tor",
54
+ "decrypt data",
55
+ "decrypt file free",
56
+ "install tor browser site",
57
+ "key snip",
58
+ "tor browser site https",
59
+ "using tor browser",
60
+ "decryption key",
61
+ "onion login",
62
+ "password snip",
63
+ "site https torproject",
64
+ "site https torproject org",
65
+ "tor browser download",
66
+ "browser https torproject",
67
+ "browser https torproject org",
68
+ "browser site https torproject",
69
+ "permanent data",
70
+ "permanent data loss",
71
+ "tor browser https torproject",
72
+ "torproject org open",
73
+ "contact soon possible",
74
+ "delete data",
75
+ "don try",
76
+ "encrypted data",
77
+ "https ibb",
78
+ "https ibb snip",
79
+ "ibb snip",
80
+ "onionmail org",
108
81
  ],
109
82
  "macros": [
110
83
  # https://github.com/cuckoosandbox/community/blob/17d57d46ccbca0327a8299cb93abba8604b74df7/modules/signatures/windows/office_enablecontent_ocr.py
assemblyline_v4_service/common/utils.py CHANGED
@@ -122,7 +122,7 @@ def _is_dev_mode() -> bool:
122
122
  read_stack_trace = stack_trace.read()
123
123
 
124
124
  if any(msg in read_stack_trace
125
- for msg in ['run_service_once', 'pytest', 'assemblyline_v4_service.testing.helper']):
125
+ for msg in ['run_service_once', 'pytest', 'assemblyline_service_utilites.testing.helper']):
126
126
  return True
127
127
 
128
128
  return False
{assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/METADATA RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: assemblyline-v4-service
3
- Version: 4.6.1.dev126
3
+ Version: 4.6.1.dev128
4
4
  Summary: Assemblyline 4 - Service base
5
5
  Home-page: https://github.com/CybercentreCanada/assemblyline-v4-service/
6
6
  Author: CCCS Assemblyline development team
{assemblyline_v4_service-4.6.1.dev126.dist-info → assemblyline_v4_service-4.6.1.dev128.dist-info}/RECORD RENAMED
@@ -1,4 +1,4 @@
1
- assemblyline_v4_service/VERSION,sha256=6pqZcpwZtI83oqH5C7yeQYVyUNgSyZbBWiwYsTkN5ts,13
1
+ assemblyline_v4_service/VERSION,sha256=_Ve__XUZtvIjkvzPFBwWdAtXgctgDEFSGlH4vEwYu-4,13
2
2
  assemblyline_v4_service/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
3
3
  assemblyline_v4_service/healthz.py,sha256=3QGBg0EZuXC6UN411HFwpLNEop9UvS9feFhvBUTP-k4,1576
4
4
  assemblyline_v4_service/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -8,12 +8,12 @@ assemblyline_v4_service/common/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5
8
8
  assemblyline_v4_service/common/api.py,sha256=Xzp8j4HCCfjPvNSGKiZl5ttH2_Itg47cjlH0NXNtth0,6849
9
9
  assemblyline_v4_service/common/base.py,sha256=psivTxiOeN2jqL3G3I26oY9JFK-qPuwrg5y_y_d7xYs,14127
10
10
  assemblyline_v4_service/common/helper.py,sha256=xs9quuf-M1JOdKieBqOmWaOece0CtzXFhhe85xQYmuY,3289
11
- assemblyline_v4_service/common/ocr.py,sha256=3fV0PyY3oui_ucAM9dkolP0VRYKACKJuGY4M64DudIE,8841
11
+ assemblyline_v4_service/common/ocr.py,sha256=NgkFqAq2lRzIveYUulKJmiiWYqwf4siYbL59n1Ow02o,8350
12
12
  assemblyline_v4_service/common/ontology_helper.py,sha256=9Ad81qbddg_pRMupT8o_KzxbKgpodaRqpc3mPoEKLtw,8494
13
13
  assemblyline_v4_service/common/request.py,sha256=W7fqC2xQE3i5i2jlCDyUDp3ZqJQQqSshNW0mQfJMkFg,11792
14
14
  assemblyline_v4_service/common/result.py,sha256=9AqM6qCYiia_Bpyn_fBFhzNQMcqJbtFSiGjp57fXW2E,32713
15
15
  assemblyline_v4_service/common/task.py,sha256=dJsvRpW0x88CCF_LW6w87jQ_UKTVaOs2Gb117IDNiU8,14233
16
- assemblyline_v4_service/common/utils.py,sha256=umEtTF92Q_Boq0gaIaY8twlwNHAmQOK9HWN6piWR42w,3916
16
+ assemblyline_v4_service/common/utils.py,sha256=FDFsFcI6wt-pWyeQYnDWivsPbtme5RqVyofmNiggh6Y,3922
17
17
  assemblyline_v4_service/dev/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
18
18
  assemblyline_v4_service/dev/run_service_once.py,sha256=W9kR49IUbkt8tNXjCT40ZMh-8p5W_odxlkDx6nhTAYM,10656
19
19
  assemblyline_v4_service/dev/updater.py,sha256=b-FK6XPRZbETbl-SIYEhnYGT-W7EcQhnxwD6x2NMC7g,6411
@@ -24,7 +24,7 @@ assemblyline_v4_service/updater/client.py,sha256=tLY84gaGdFBVIDaMgRHIEa7x2S8jBl7
24
24
  assemblyline_v4_service/updater/gunicorn_config.py,sha256=p3j2KPBeD5jvMw9O5i7vAtlRgPSVVxIG9AO0DfN82J8,1247
25
25
  assemblyline_v4_service/updater/helper.py,sha256=GeXrfuPQL0RB5IGcgvx30vcCEehUueorw6SMSExjE9Q,10751
26
26
  assemblyline_v4_service/updater/updater.py,sha256=XiqabDp89-t_J6C3U33R-RvA5lMIahFW_MsAVUGyXok,31876
27
- assemblyline_v4_service-4.6.1.dev126.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
27
+ assemblyline_v4_service-4.6.1.dev128.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
28
28
  test/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
29
29
  test/conftest.py,sha256=W3SieQpZsZpGEmtLqY4aIlxREDSsHceyCrFcFsWUM0U,1851
30
30
  test/test_healthz.py,sha256=DkeLUlrb7rGx3nZ04aADU9HXXu5mZTf_DBwT0xhzIv4,7
@@ -34,13 +34,13 @@ test/test_common/__init__.py,sha256=RkOm3vnVp5L947mD1jTo4bdOgLTZJ24_NX-kqfMn5a8,
34
34
  test/test_common/test_api.py,sha256=7wlo7wgB12T23zMLbwjJ3GIomLHqE_Qvs3xkibSsR1U,4902
35
35
  test/test_common/test_base.py,sha256=fuJSSlPxIDHq6HU1xbvaMFitw2z1spOZNHD2SJ4UUic,13346
36
36
  test/test_common/test_helper.py,sha256=sO6YAiBhKTqaxlpLhFYDuy2ZdbuF2cg07Ylzo83ZzQs,2575
37
- test/test_common/test_ocr.py,sha256=mt_PgElgwQKJmNrp2nRVx9NjfMedVk40I6IV317vATI,1753
37
+ test/test_common/test_ocr.py,sha256=_z0VnwhMjxheudRbOustezIG3VUBXLiZMOuKLz50Ix0,1767
38
38
  test/test_common/test_ontology_helper.py,sha256=Q9-Eqeo8Ih7XlbFmlUAXCtgnfW8JCDqqlYFb56077h4,10331
39
39
  test/test_common/test_request.py,sha256=Ceyds8BNO1O0f1kH1VEb84faJcaupvSjVKIrGdHexsc,11842
40
40
  test/test_common/test_result.py,sha256=6BiOKxEPrKBjOY44jv3TY-yiXm0qI1ok_CZBnjP9TM4,45447
41
41
  test/test_common/test_task.py,sha256=P44mNcSe-3tJgDk9ppN3KbM7oN4LBVIuhONG-Gveh74,19007
42
42
  test/test_common/test_utils.py,sha256=TbnBxqpS_ZC5ptXR9XJX3xtbItD0mTbtiBxxdyP8J5k,5904
43
- assemblyline_v4_service-4.6.1.dev126.dist-info/METADATA,sha256=VnBfzxDjRWRT-XZq3yC5xnDrYrjo2ifG8R6WxcIUjtU,5625
44
- assemblyline_v4_service-4.6.1.dev126.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
45
- assemblyline_v4_service-4.6.1.dev126.dist-info/top_level.txt,sha256=LpTOEaVCatkrvbVq3EZseMSIa2PQZU-2rhuO_FTpZgY,29
46
- assemblyline_v4_service-4.6.1.dev126.dist-info/RECORD,,
43
+ assemblyline_v4_service-4.6.1.dev128.dist-info/METADATA,sha256=k8xVaJj7W5L4Ra7ENpO9dd2VTm8v-BhEWa7j4vy3ky8,5625
44
+ assemblyline_v4_service-4.6.1.dev128.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
45
+ assemblyline_v4_service-4.6.1.dev128.dist-info/top_level.txt,sha256=LpTOEaVCatkrvbVq3EZseMSIa2PQZU-2rhuO_FTpZgY,29
46
+ assemblyline_v4_service-4.6.1.dev128.dist-info/RECORD,,
test/test_common/test_ocr.py CHANGED
@@ -40,4 +40,4 @@ def test_detections():
40
40
  assert detections("blah\nrecover them\nblah") == {}
41
41
 
42
42
  # Containing two ransomware strings
43
- assert detections("blah\nrecover them\nblah\nencrypt") == {"ransomware": ["recover them", "encrypt"]}
43
+ assert detections("blah\nrecover data\nblah\nencrypted data") == {"ransomware": ["recover data", "encrypted data"]}