Skip to content

Commit

Permalink
Update packer_mpress.py
Browse files Browse the repository at this point in the history
Correct signature to PE static info format
  • Loading branch information
kevross33 authored Oct 4, 2024
1 parent 2bcef9d commit 9a8efee
Showing 1 changed file with 11 additions and 6 deletions.
17 changes: 11 additions & 6 deletions modules/signatures/all/packer_mpress.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@

from lib.cuckoo.common.abstracts import Signature


class MPressPacked(Signature):
name = "packer_mpress"
description = "Executable file is packed/obfuscated with MPRESS"
Expand All @@ -29,9 +28,15 @@ class MPressPacked(Signature):
mbcs = ["OB0001", "OB0002", "OB0006", "F0001"]

def run(self):
for section in self.results.get("static", {}).get("pe", {}).get("sections", []):
if section["name"].lower().startswith(".mpress"):
self.data.append({"section": section})
return True
ret = False

target = self.results.get("target", {})
if target.get("category") in ("file", "static") and target.get("file"):
pe = self.results["target"]["file"].get("pe", [])
if pe:
for section in pe["sections"]:
if section["name"].lower().startswith(".mpress"):
self.data.append({"section": section})
ret = True

return False
return ret

0 comments on commit 9a8efee

Please sign in to comment.