Skip to content

Commit

Permalink
Update packer_vmprotect.py
Browse files Browse the repository at this point in the history
Correct signature to use new format for PE static info
  • Loading branch information
kevross33 authored Oct 4, 2024
1 parent 2bcef9d commit c5270d9
Showing 1 changed file with 9 additions and 6 deletions.
15 changes: 9 additions & 6 deletions modules/signatures/all/packer_vmprotect.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@

from lib.cuckoo.common.abstracts import Signature


class VMPPacked(Signature):
name = "packer_vmprotect"
description = "The executable is likely packed with VMProtect"
Expand All @@ -29,11 +28,15 @@ class VMPPacked(Signature):
mbcs = ["OB0001", "OB0002", "OB0006", "F0001", "F0001.010"]

def run(self):
if "static" in self.results and "pe" in self.results["static"]:
if "sections" in self.results["static"]["pe"]:
for section in self.results["static"]["pe"]["sections"]:
ret = False

target = self.results.get("target", {})
if target.get("category") in ("file", "static") and target.get("file"):
pe = self.results["target"]["file"].get("pe", [])
if pe:
for section in pe["sections"]:
if section["name"].lower().startswith(".vmp"):
self.data.append({"section": section})
return True
ret= True

return False
return ret

0 comments on commit c5270d9

Please sign in to comment.