standardize the keys used for extracted artefacts

cuckoo/common/objects.py

@@ -463,4 +463,4 @@ class ExtractedMatch(object):
 
         # Raw payload.
         self.raw = match.get("raw")
-        self.payload = match[self.category]
+        self.info = match["info"]

cuckoo/core/extract.py

@@ -41,7 +41,7 @@ class ExtractManager(object):
                     "compatible with this Extractor (either it's too old or "
                     "too new): cuckoo=%s extractor=%s minversion=%s "
                     "maxversion=%s",
-                    version, ext.__class__.__name__, ext.minimum, ext.maximum
+                    version, ext.__name__, ext.minimum, ext.maximum
                 )
                 continue
 
@@ -95,8 +95,9 @@ class ExtractManager(object):
             "program": command.program,
             "pid": process.get("pid"),
             "first_seen": process.get("first_seen"),
-            "script": filepath,
+            "raw": filepath,
             "yara": yara_matches,
+            "info": {},
         })
         for match in yara_matches:
             match = YaraMatch(match, "script")
@@ -119,8 +120,10 @@ class ExtractManager(object):
         self.items.append({
             "category": "shellcode",
             "raw": filepath,
-            "shellcode": "%s.txt" % filepath,
             "yara": yara_matches,
+            "info": {
+                "pretty": "%s.txt" % filepath,
+            },
         })
         for match in yara_matches:
             match = YaraMatch(match, "shellcode")
@@ -137,7 +140,7 @@ class ExtractManager(object):
             "category": category,
             "raw": filepath,
             "yara": yara_matches,
-            category: info or {},
+            "info": info or {},
         })
         for match in yara_matches:
             match = YaraMatch(match, category)
@@ -152,13 +155,13 @@ class ExtractManager(object):
             "category": category,
             "raw": filepath,
             "yara": [],
-            category: info or {},
+            "info": info or {},
         })
 
     def enhance(self, filepath, key, value):
         for item in self.items:
             if item["raw"] == filepath:
-                item[item["category"]][key] = value
+                item["info"][key] = value
                 break
 
     def peek_office(self, files):

cuckoo/core/plugins.py

@@ -484,7 +484,7 @@ class RunSignatures(object):
             loop_yara("dropped", dropped["path"], dropped["yara"])
 
         for extr in self.results.get("extracted", []):
-            loop_yara("extracted", extr[extr["category"]], extr["yara"])
+            loop_yara("extracted", extr["raw"], extr["yara"])
 
     def process_extracted(self):
         task_id = self.results.get("info", {}).get("id")

cuckoo/reporting/mongodb.py

@@ -160,7 +160,7 @@ class MongoDB(Report):
         if "extracted" in report:
             for extracted in report["extracted"]:
                 new_extr = dict(extracted)
-                extr = File(extracted[extracted["category"]])
+                extr = File(extracted["raw"])
                 if extr.valid():
                     extr_id = self.store_file(extr)
                     new_extr["object_id"] = extr_id

tests/test_processing.py

@@ -927,18 +927,20 @@ class TestBehavior(object):
             "first_seen": 1,
             "pid": 1234,
             "program": "cmd",
-            "script": cwd("extracted", "0.bat", analysis=1),
+            "raw": cwd("extracted", "0.bat", analysis=1),
             "yara": [],
+            "info": {},
         }, {
             "category": "script",
             "first_seen": 2,
             "pid": 1235,
             "program": "powershell",
-            "script": cwd("extracted", "1.ps1", analysis=1),
+            "raw": cwd("extracted", "1.ps1", analysis=1),
             "yara": [],
+            "info": {},
         }]
-        assert open(out[0]["script"], "rb").read() == "ping 1.2.3.4"
-        assert open(out[1]["script"], "rb").read() == 'echo "Recursive"'
+        assert open(out[0]["raw"], "rb").read() == "ping 1.2.3.4"
+        assert open(out[1]["raw"], "rb").read() == 'echo "Recursive"'
 
     def test_stap_log(self):
         set_cwd(tempfile.mkdtemp())

tests/test_signatures.py

@@ -416,8 +416,9 @@ def test_on_extract():
         "pid": 1,
         "first_seen": 2,
         "program": "cmd",
-        "script": cwd("extracted", "0.bat", analysis=2),
+        "raw": cwd("extracted", "0.bat", analysis=2),
         "yara": [],
+        "info": {},
     }]
 
     class sig1(object):

tests/test_static.py

@@ -51,15 +51,15 @@ def test_docx_lnk():
         },
     }
     e1, e2, e3 = e
-    assert e1["office"] == {}
+    assert e1["info"] == {}
     assert len(e1["yara"]) == 1
     assert e2["category"] == "binaries"
-    assert e2["binaries"] == {
+    assert e2["info"] == {
         "filename": " ",
         "src_path": mock.ANY,
         "temp_path": mock.ANY,
         "lnk": mock.ANY,
     }
-    assert "http" in e2["binaries"]["lnk"]["cmdline"]
+    assert "http" in e2["info"]["lnk"]["cmdline"]
     assert len(e3["yara"]) == 1
     assert e3["yara"][0]["name"] == "PowershellDI"