assemblyline-v4-service 4.6.1.dev174__py3-none-any.whl → 4.6.1.dev176__py3-none-any.whl

assemblyline_v4_service/VERSION

@@ -1 +1 @@
-4.6.1.dev174
+4.6.1.dev176

assemblyline_v4_service/updater/helper.py

@@ -163,7 +163,7 @@ def url_download(source: Dict[str, Any], previous_update: int, logger: Logger, o
                 format = ident_type.split('archive/')[-1]
 
                 # Make sure identified format is supported by the library
-                format = format if format in ["zip", "tar"] else None
+                format = {"zip": "zip", "tar": "tar", "gzip": "gztar"}.get(format)
                 shutil.unpack_archive(file_path, extract_dir=extract_dir, format=format)
 
                 return extract_dir

{assemblyline_v4_service-4.6.1.dev174.dist-info → assemblyline_v4_service-4.6.1.dev176.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline-v4-service
-Version: 4.6.1.dev174
+Version: 4.6.1.dev176
 Summary: Assemblyline 4 - Service base
 Home-page: https://github.com/CybercentreCanada/assemblyline-v4-service/
 Author: CCCS Assemblyline development team

{assemblyline_v4_service-4.6.1.dev174.dist-info → assemblyline_v4_service-4.6.1.dev176.dist-info}/RECORD

@@ -1,4 +1,4 @@
-assemblyline_v4_service/VERSION,sha256=EbxBEyOZ_dSv5suFza-J4T2HrLb4_ETNJ4-tUrTOO4Q,13
+assemblyline_v4_service/VERSION,sha256=fSIbUEct3V93DEUYz2IKzFAuxeO3mihXcI4c70NPZX0,13
 assemblyline_v4_service/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 assemblyline_v4_service/healthz.py,sha256=3QGBg0EZuXC6UN411HFwpLNEop9UvS9feFhvBUTP-k4,1576
 assemblyline_v4_service/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -22,9 +22,9 @@ assemblyline_v4_service/updater/__main__.py,sha256=9Os-u8Tf7MD73JSrUSPmOaErTgfve
 assemblyline_v4_service/updater/app.py,sha256=Mtmx4bkXfP4nFqqa5q15jW8QIXr4JK84lCovxAVyvPs,3317
 assemblyline_v4_service/updater/client.py,sha256=tLY84gaGdFBVIDaMgRHIEa7x2S8jBl7lQLzp4seC6aI,11200
 assemblyline_v4_service/updater/gunicorn_config.py,sha256=p3j2KPBeD5jvMw9O5i7vAtlRgPSVVxIG9AO0DfN82J8,1247
-assemblyline_v4_service/updater/helper.py,sha256=GeXrfuPQL0RB5IGcgvx30vcCEehUueorw6SMSExjE9Q,10751
+assemblyline_v4_service/updater/helper.py,sha256=OTV6WA77wBDOSVWaxijNg-HpwvEwnZozH03S3Q4oUns,10764
 assemblyline_v4_service/updater/updater.py,sha256=XiqabDp89-t_J6C3U33R-RvA5lMIahFW_MsAVUGyXok,31876
-assemblyline_v4_service-4.6.1.dev174.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
+assemblyline_v4_service-4.6.1.dev176.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
 test/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 test/conftest.py,sha256=W3SieQpZsZpGEmtLqY4aIlxREDSsHceyCrFcFsWUM0U,1851
 test/test_healthz.py,sha256=DkeLUlrb7rGx3nZ04aADU9HXXu5mZTf_DBwT0xhzIv4,7
@@ -34,13 +34,13 @@ test/test_common/__init__.py,sha256=RkOm3vnVp5L947mD1jTo4bdOgLTZJ24_NX-kqfMn5a8,
 test/test_common/test_api.py,sha256=7wlo7wgB12T23zMLbwjJ3GIomLHqE_Qvs3xkibSsR1U,4902
 test/test_common/test_base.py,sha256=fuJSSlPxIDHq6HU1xbvaMFitw2z1spOZNHD2SJ4UUic,13346
 test/test_common/test_helper.py,sha256=sO6YAiBhKTqaxlpLhFYDuy2ZdbuF2cg07Ylzo83ZzQs,2575
-test/test_common/test_ocr.py,sha256=_z0VnwhMjxheudRbOustezIG3VUBXLiZMOuKLz50Ix0,1767
+test/test_common/test_ocr.py,sha256=X_Y3c_yfRljD0o2SRUHuotKLTTX0lD5zW68mzQ7LKu4,1250
 test/test_common/test_ontology_helper.py,sha256=Q9-Eqeo8Ih7XlbFmlUAXCtgnfW8JCDqqlYFb56077h4,10331
-test/test_common/test_request.py,sha256=Ceyds8BNO1O0f1kH1VEb84faJcaupvSjVKIrGdHexsc,11842
-test/test_common/test_result.py,sha256=6BiOKxEPrKBjOY44jv3TY-yiXm0qI1ok_CZBnjP9TM4,45447
+test/test_common/test_request.py,sha256=HiDU1n4Rjso_U0qDME4ohA_9j7rpfqLSD1-e2RfqDYs,11186
+test/test_common/test_result.py,sha256=ZtLUddBDA_BTIjG3Jasbq78_AdEjCRe4cb85XLBwH5o,43585
 test/test_common/test_task.py,sha256=P44mNcSe-3tJgDk9ppN3KbM7oN4LBVIuhONG-Gveh74,19007
 test/test_common/test_utils.py,sha256=TbnBxqpS_ZC5ptXR9XJX3xtbItD0mTbtiBxxdyP8J5k,5904
-assemblyline_v4_service-4.6.1.dev174.dist-info/METADATA,sha256=m9zaoF4cUq42hr9s9qIib0eenp5zgqBbfsS75JbiG4E,5625
-assemblyline_v4_service-4.6.1.dev174.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-assemblyline_v4_service-4.6.1.dev174.dist-info/top_level.txt,sha256=LpTOEaVCatkrvbVq3EZseMSIa2PQZU-2rhuO_FTpZgY,29
-assemblyline_v4_service-4.6.1.dev174.dist-info/RECORD,,
+assemblyline_v4_service-4.6.1.dev176.dist-info/METADATA,sha256=_ldzkgtEFhAO5qM6OjXj4lJ1sUZQ-7RUG0pwhqftS1I,5625
+assemblyline_v4_service-4.6.1.dev176.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+assemblyline_v4_service-4.6.1.dev176.dist-info/top_level.txt,sha256=LpTOEaVCatkrvbVq3EZseMSIa2PQZU-2rhuO_FTpZgY,29
+assemblyline_v4_service-4.6.1.dev176.dist-info/RECORD,,

test/test_common/test_ocr.py

@@ -1,29 +1,29 @@
 import os
-from test.test_common import TESSERACT_LIST
 
 import pytest
+from assemblyline_v4_service.common.ocr import (
+    detections,
+    ocr_detections,
+    update_ocr_config,
+)
+
+from test.test_common import TESSERACT_LIST
 
-from assemblyline_v4_service.common.ocr import ocr_detections, detections, update_ocr_config
 
-@pytest.mark.skipif(len(TESSERACT_LIST) < 1, reason="Requires tesseract-ocr apt package")
+@pytest.mark.skipif(
+    len(TESSERACT_LIST) < 1, reason="Requires tesseract-ocr apt package"
+)
 def test_ocr_detections():
     update_ocr_config()
-    file_path = os.path.join(os.path.dirname(__file__), "b32969aa664e3905c20f865cdd7b921f922678f5c3850c78e4c803fbc1757a8e")
+    file_path = os.path.join(
+        os.path.dirname(__file__),
+        "094177fc6c4642f12fbf6dce18f272227ace95576ff1765384902d2abebf09bf",
+    )
     assert ocr_detections(file_path) == {
-        'ransomware': [
-            "YOUR FILES HAVE BEEN ENCRYPTED AND YOU WON'T BE ABLE TO "
-            'DECRYPT THEM.',
-            'YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL '
-            'ALLOW YOU TO RECOVER ALL OF YOUR DATA AND',
-            'RANSOMWARE FROM YOUR COMPUTER. THE PRICE OF THE SOFTWARE IS '
-            '$.2..%.. PAYMENT CAN BE MADE IN BITCOIN OR XMR.',
-            'How 00! PAY, WHERE DO | GET BITCOIN OR XMR?',
-            'YOURSELF TO FIND OUT HOW TO BUY BITCOIN OR XMR.',
-            'PAYMENT INFORMATION: SEND $15, TO ONE OF OUR CRYPTO '
-            'ADDRESSES, THEN SEND US EMAIL WITH PAYMENT',
-            "CONFIRMATION AND YOU'LL GET THE DECRYPTION SOFTWARE IN EMAIL.",
-            "BTC ADDRESS : bciqsht77cpgw7kv420r4secmu88g34wvn96dsyc5s",
-        ],
+        "ransomware": [
+            "YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA AND",
+            "CONFIRMATION AND YOU'LL GET THE DECRYPTION KEY IN EMAIL.",
+        ]
     }
 
 
@@ -40,4 +40,6 @@ def test_detections():
     assert detections("blah\nrecover them\nblah") == {}
 
     # Containing two ransomware strings
-    assert detections("blah\nrecover data\nblah\nencrypted data") == {"ransomware": ["recover data", "encrypted data"]}
+    assert detections("blah\nrecover data\nblah\nencrypted data") == {
+        "ransomware": ["recover data", "encrypted data"]
+    }

test/test_common/test_request.py

@@ -1,7 +1,6 @@
 import os
 import tempfile
 from logging import Logger
-from test.test_common import TESSERACT_LIST, setup_module
 
 import pytest
 from assemblyline_v4_service.common.request import ServiceRequest
@@ -9,6 +8,7 @@ from assemblyline_v4_service.common.result import Result, get_heuristic_primitiv
 from assemblyline_v4_service.common.task import MaxExtractedExceeded, Task
 
 from assemblyline.odm.messages.task import Task as ServiceTask
+from test.test_common import TESSERACT_LIST, setup_module
 
 # Ensure service manifest is instantiated before importing from OCR submodule
 setup_module()
@@ -112,19 +112,19 @@ def test_add_extracted(service_request):
 def test_add_image(service_request):
     image_path = os.path.join(
         os.path.dirname(__file__),
-        "b32969aa664e3905c20f865cdd7b921f922678f5c3850c78e4c803fbc1757a8e")
+        "094177fc6c4642f12fbf6dce18f272227ace95576ff1765384902d2abebf09bf")
 
     # Basic
     assert service_request.add_image(image_path, "image_name", "description of image") == {
         'img': {
             'description': 'description of image',
             'name': 'image_name',
-            'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329'
+            'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f'
         },
         'thumb': {
             'description': 'description of image (thumbnail)',
             'name': 'image_name.thumb',
-            'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901'
+            'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8'
         }
     }
 
@@ -139,7 +139,7 @@ def test_add_image(service_request):
             'is_supplementary': True,
             'name': 'image_name',
             'parent_relation': 'INFORMATION',
-            'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329'
+            'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f'
         },
         {
             'allow_dynamic_recursion': False,
@@ -149,7 +149,7 @@ def test_add_image(service_request):
             'is_supplementary': True,
             'name': 'image_name.thumb',
             'parent_relation': 'INFORMATION',
-            'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901'
+            'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8'
         },
     ]
 
@@ -164,31 +164,19 @@ def test_add_image(service_request):
     assert data["img"] == {
         'description': 'description of image',
         'name': 'image_name',
-        'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329'
+        'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f'
     }
     assert data["thumb"] == {
         'description': 'description of image (thumbnail)',
         'name': 'image_name.thumb',
-        'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901'
+        'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8'
     }
     assert data["ocr_section"].__dict__["section_body"].__dict__ == {
         '_config': {},
         '_data': {
-            'ransomware': [
-                "YOUR FILES HAVE BEEN ENCRYPTED AND YOU WON'T BE "
-                'ABLE TO DECRYPT THEM.',
-                'YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS '
-                'SOFTWARE WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA '
-                'AND',
-                'RANSOMWARE FROM YOUR COMPUTER. THE PRICE OF THE '
-                'SOFTWARE IS $.2..%.. PAYMENT CAN BE MADE IN BITCOIN '
-                'OR XMR.',
-                'How 00! PAY, WHERE DO | GET BITCOIN OR XMR?',
-                'YOURSELF TO FIND OUT HOW TO BUY BITCOIN OR XMR.',
-                'PAYMENT INFORMATION: SEND $15, TO ONE OF OUR CRYPTO '
-                'ADDRESSES, THEN SEND US EMAIL WITH PAYMENT',
-                "CONFIRMATION AND YOU'LL GET THE DECRYPTION SOFTWARE IN EMAIL.",
-                "BTC ADDRESS : bciqsht77cpgw7kv420r4secmu88g34wvn96dsyc5s",
+            "ransomware": [
+                "YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA AND",
+                "CONFIRMATION AND YOU'LL GET THE DECRYPTION KEY IN EMAIL.",
             ]
         },
         '_format': 'KEY_VALUE'
@@ -197,8 +185,8 @@ def test_add_image(service_request):
     heur_dict = get_heuristic_primitives(data["ocr_section"].__dict__["_heuristic"])
 
     assert heur_dict == {
-        'heur_id': 1, 'score': 1200, 'attack_ids': ['T1005'],
-        'signatures': {'ransomware_strings': 8},
+        'heur_id': 1, 'score': 500, 'attack_ids': ['T1005'],
+        'signatures': {'ransomware_strings': 2},
         'frequency': 0, 'score_map': {}}
 
     assert service_request.temp_submission_data == {}

test/test_common/test_result.py

@@ -1,17 +1,50 @@
-from assemblyline.odm.messages.task import Task as ServiceTask
-from assemblyline_v4_service.common.task import Task
-from assemblyline_v4_service.common.result import (
-    BODY_FORMAT, DividerSectionBody, GraphSectionBody, Heuristic, ImageSectionBody, InvalidFunctionException,
-    InvalidHeuristicException, JSONSectionBody, KVSectionBody, MemorydumpSectionBody, MultiSectionBody,
-    OrderedKVSectionBody, ProcessItem, ProcessTreeSectionBody, Result, ResultAggregationException, ResultGraphSection,
-    ResultImageSection, ResultJSONSection, ResultKeyValueSection, ResultMemoryDumpSection, ResultMultiSection,
-    ResultOrderedKeyValueSection, ResultProcessTreeSection, ResultSection, ResultTableSection, ResultTextSection,
-    ResultTimelineSection, ResultURLSection, SectionBody, TableRow, TableSectionBody, TextSectionBody,
-    TimelineSectionBody, TypeSpecificResultSection, URLSectionBody, get_heuristic_primitives)
-from assemblyline_v4_service.common.request import ServiceRequest
-import pytest
 import os
 import tempfile
+
+import pytest
+from assemblyline_v4_service.common.request import ServiceRequest
+from assemblyline_v4_service.common.result import (
+    BODY_FORMAT,
+    DividerSectionBody,
+    GraphSectionBody,
+    Heuristic,
+    ImageSectionBody,
+    InvalidFunctionException,
+    InvalidHeuristicException,
+    JSONSectionBody,
+    KVSectionBody,
+    MemorydumpSectionBody,
+    MultiSectionBody,
+    OrderedKVSectionBody,
+    ProcessItem,
+    ProcessTreeSectionBody,
+    Result,
+    ResultAggregationException,
+    ResultGraphSection,
+    ResultImageSection,
+    ResultJSONSection,
+    ResultKeyValueSection,
+    ResultMemoryDumpSection,
+    ResultMultiSection,
+    ResultOrderedKeyValueSection,
+    ResultProcessTreeSection,
+    ResultSection,
+    ResultTableSection,
+    ResultTextSection,
+    ResultTimelineSection,
+    ResultURLSection,
+    SectionBody,
+    TableRow,
+    TableSectionBody,
+    TextSectionBody,
+    TimelineSectionBody,
+    TypeSpecificResultSection,
+    URLSectionBody,
+    get_heuristic_primitives,
+)
+from assemblyline_v4_service.common.task import Task
+
+from assemblyline.odm.messages.task import Task as ServiceTask
 from test.test_common import TESSERACT_LIST, setup_module
 
 # Ensure service manifest is instantiated before importing from OCR submodule
@@ -602,18 +635,18 @@ def test_imagesectionbody_add_image(service_request):
     isb = ImageSectionBody(service_request)
     image_path = os.path.join(
         os.path.dirname(__file__),
-        "b32969aa664e3905c20f865cdd7b921f922678f5c3850c78e4c803fbc1757a8e")
+        "094177fc6c4642f12fbf6dce18f272227ace95576ff1765384902d2abebf09bf")
 
     # Basic
     assert isb.add_image(image_path, "image_name", "description of image") is None
     assert isb._data == [
         {'img': {
             'name': 'image_name',
-            'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329',
+            'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f',
             'description': 'description of image'},
          'thumb': {
              'name': 'image_name.thumb',
-             'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901',
+             'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8',
              'description': 'description of image (thumbnail)'}}]
 
     isb._data.clear()
@@ -623,23 +656,15 @@ def test_imagesectionbody_add_image(service_request):
     _, path = tempfile.mkstemp()
     ocr_io = open(path, "w")
     assert isb.add_image(image_path, "image_name", "description of image", "TLP:A", ocr_heuristic_id,
-                         ocr_io).body == '{"ransomware": ["YOUR FILES HAVE BEEN ENCRYPTED AND YOU WON\'T BE ABLE TO ' \
-                                         'DECRYPT THEM.", "YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE ' \
-                                         'WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA AND", "RANSOMWARE FROM YOUR ' \
-                                         'COMPUTER. THE PRICE OF THE SOFTWARE IS $.2..%.. PAYMENT CAN BE MADE IN ' \
-                                         'BITCOIN OR XMR.", "How 00! PAY, WHERE DO | GET BITCOIN OR XMR?", "YOURSELF ' \
-                                         'TO FIND OUT HOW TO BUY BITCOIN OR XMR.", "PAYMENT INFORMATION: SEND $15, ' \
-                                         'TO ONE OF OUR CRYPTO ADDRESSES, THEN SEND US EMAIL WITH PAYMENT", ' \
-                                         '"CONFIRMATION AND YOU\'LL GET THE DECRYPTION SOFTWARE IN EMAIL.", ' \
-                                         '"BTC ADDRESS : bciqsht77cpgw7kv420r4secmu88g34wvn96dsyc5s"]}'
+                         ocr_io).body == '{"ransomware": ["YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA AND", "CONFIRMATION AND YOU\'LL GET THE DECRYPTION KEY IN EMAIL."]}'
     assert isb._data == [
         {'img': {
             'name': 'image_name',
-            'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329',
+            'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f',
             'description': 'description of image'},
          'thumb': {
             'name': 'image_name.thumb',
-            'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901',
+            'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8',
             'description': 'description of image (thumbnail)'}}]
 
 
@@ -1281,18 +1306,18 @@ def test_resultimagesection_add_image(service_request):
     ris = ResultImageSection(service_request, "title_text_as_str")
 
     image_path = os.path.join(os.path.dirname(__file__),
-                              "b32969aa664e3905c20f865cdd7b921f922678f5c3850c78e4c803fbc1757a8e")
+                              "094177fc6c4642f12fbf6dce18f272227ace95576ff1765384902d2abebf09bf")
 
     # Basic
     assert ris.add_image(image_path, "image_name", "description of image") is None
     assert ris.section_body._data == [{
         'img':
                                       {'name': 'image_name',
-                                       'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329',
+                                       'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f',
                                        'description': 'description of image'},
                                       'thumb':
                                       {'name': 'image_name.thumb',
-                                       'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901',
+                                       'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8',
                                        'description': 'description of image (thumbnail)'}}]
 
     ris = ResultImageSection(service_request, "title_text_as_str")
@@ -1305,11 +1330,11 @@ def test_resultimagesection_add_image(service_request):
     assert ris.section_body._data == [{
         'img':
                                       {'name': 'image_name',
-                                       'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329',
+                                       'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f',
                                        'description': 'description of image'},
                                       'thumb':
                                       {'name': 'image_name.thumb',
-                                       'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901',
+                                       'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8',
                                        'description': 'description of image (thumbnail)'}}]
 
     ris = ResultImageSection(service_request, "title_text_as_str")
@@ -1319,26 +1344,15 @@ def test_resultimagesection_add_image(service_request):
     _, path = tempfile.mkstemp()
     ocr_io = open(path, "w")
     assert ris.add_image(image_path, "image_name", "description of image", "TLP:A", ocr_heuristic_id, ocr_io,
-                         auto_add_ocr_section=False).body == '{"ransomware": ["YOUR FILES HAVE BEEN ENCRYPTED AND ' \
-                                                             'YOU WON\'T BE ABLE TO DECRYPT THEM.", "YOU CAN BUY ' \
-                                                             'DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL ALLOW ' \
-                                                             'YOU TO RECOVER ALL OF YOUR DATA AND", "RANSOMWARE FROM ' \
-                                                             'YOUR COMPUTER. THE PRICE OF THE SOFTWARE IS $.2..%.. ' \
-                                                             'PAYMENT CAN BE MADE IN BITCOIN OR XMR.", "How 00! PAY, ' \
-                                                             'WHERE DO | GET BITCOIN OR XMR?", "YOURSELF TO FIND OUT ' \
-                                                             'HOW TO BUY BITCOIN OR XMR.", "PAYMENT INFORMATION: ' \
-                                                             'SEND $15, TO ONE OF OUR CRYPTO ADDRESSES, THEN SEND ' \
-                                                             'US EMAIL WITH PAYMENT", "CONFIRMATION AND YOU\'LL GET ' \
-                                                             'THE DECRYPTION SOFTWARE IN EMAIL.", "BTC ADDRESS : ' \
-                                                             'bciqsht77cpgw7kv420r4secmu88g34wvn96dsyc5s"]}'
+                         auto_add_ocr_section=False).body == '{"ransomware": ["YOU CAN BUY DECRYPTION SOFTWARE FROM US, THIS SOFTWARE WILL ALLOW YOU TO RECOVER ALL OF YOUR DATA AND", "CONFIRMATION AND YOU\'LL GET THE DECRYPTION KEY IN EMAIL."]}'
     assert ris.section_body._data == [{
         'img': {
             'name': 'image_name',
-            'sha256': '09bf99ab5431af13b701a06dc2b04520aea9fd346584fa2a034d6d4af0c57329',
+            'sha256': 'f52a9f1cf33e800e804c100908206525d794f15a92d9637dc03226a84e26810f',
             'description': 'description of image'},
         'thumb': {
             'name': 'image_name.thumb',
-            'sha256': '1af0e0d99845493b64cf402b3704170f17ecf15001714016e48f9d4854218901',
+            'sha256': '00b5239a2d010b64e2a35fae38671bdda44c60cc4008af361d98bb1d12a845e8',
             'description': 'description of image (thumbnail)'}}]
 
     # Ensure that the image files added are marked as `is_image_section`