assemblyline 4.5.0.dev9__tar.gz → 4.5.0.dev11__tar.gz

{assemblyline-4.5.0.dev9/assemblyline.egg-info → assemblyline-4.5.0.dev11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.5.0.dev9
+Version: 4.5.0.dev11
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.5.0.dev11/assemblyline/VERSION

@@ -0,0 +1 @@
+4.5.0.dev11

{assemblyline-4.5.0.dev9 → assemblyline-4.5.0.dev11}/assemblyline/common/identify.py

@@ -322,10 +322,17 @@ class Identify():
 
         return fallback
 
-    def fileinfo(self, path: str, generate_hashes: bool = True, skip_fuzzy_hashes: bool = False) -> Dict:
+    def fileinfo(
+        self, path: str, generate_hashes: bool = True, skip_fuzzy_hashes: bool = False, calculate_entropy: bool = True
+    ) -> Dict:
         path = safe_str(path)
         if generate_hashes:
-            data = get_digests_for_file(path, on_first_block=self.ident, skip_fuzzy_hashes=skip_fuzzy_hashes)
+            data = get_digests_for_file(
+                path,
+                on_first_block=self.ident,
+                skip_fuzzy_hashes=skip_fuzzy_hashes,
+                calculate_entropy=calculate_entropy,
+            )
         else:
             with open(path, 'rb') as f:
                 first_block = f.read(DEFAULT_BLOCKSIZE)

{assemblyline-4.5.0.dev9 → assemblyline-4.5.0.dev11}/assemblyline/odm/models/config.py

@@ -108,6 +108,7 @@ class LDAP(odm.Model):
     classification_mappings: Dict[str, str] = odm.Any(description="Classification mapping")
     email_field: str = odm.Keyword(description="Name of the field containing the email address")
     group_lookup_query: str = odm.Keyword(description="How the group lookup is queried")
+    group_lookup_with_uid: bool = odm.Boolean(description="Use username/uid instead of dn for group lookup")
     image_field: str = odm.Keyword(description="Name of the field containing the user's avatar")
     image_format: str = odm.Keyword(description="Type of image used to store the avatar")
     name_field: str = odm.Keyword(description="Name of the field containing the user's name")
@@ -131,6 +132,7 @@ DEFAULT_LDAP = {
     "base": "ou=people,dc=assemblyline,dc=local",
     "email_field": "mail",
     "group_lookup_query": "(&(objectClass=Group)(member=%s))",
+    "group_lookup_with_uid": False,
     "image_field": "jpegPhoto",
     "image_format": "jpeg",
     "name_field": "cn",

{assemblyline-4.5.0.dev9 → assemblyline-4.5.0.dev11}/assemblyline/odm/models/tagging.py

@@ -269,7 +269,16 @@ class Tagging(odm.Model):
                 description = odm.Optional(odm.List(odm.Keyword(copyto="__text__")), description="Description")
                 filename = odm.Optional(odm.List(odm.Keyword(copyto="__text__")), description="Filename")
 
+            @odm.model(index=True, store=False, description="PE Authenticode Model")
+            class FilePEAuthenticode(odm.Model):
+                @odm.model(index=True, store=False, description="PE SpcSpOpusInfo Attribute Model")
+                class FilePEAuthenticodeSpcSpOpusInfo(odm.Model):
+                    program_name = odm.Optional(odm.List(odm.Keyword(copyto="__text__")), description="Program Name")
+
+                spc_sp_opus_info = odm.Optional(odm.Compound(FilePEAuthenticodeSpcSpOpusInfo), description="AAA")
+
             api_vector = odm.Optional(odm.List(odm.Keyword(copyto="__text__")), description="API Vector")
+            authenticode = odm.Optional(odm.Compound(FilePEAuthenticode), description="PE Authenticode Information")
             debug = odm.Optional(odm.Compound(FilePEDebug), description="PE Debug Information")
             exports = odm.Optional(odm.Compound(FilePEExports), description="PE Exports Information")
             imports = odm.Optional(odm.Compound(FilePEImports), description="PE Imports Information")

{assemblyline-4.5.0.dev9 → assemblyline-4.5.0.dev11/assemblyline.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: assemblyline
-Version: 4.5.0.dev9
+Version: 4.5.0.dev11
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.5.0.dev9/assemblyline/VERSION

@@ -1 +0,0 @@
-4.5.0.dev9