valitydev/Cortex-Analyzers
14
0
Fork 0
mirror of https://github.com/valitydev/Cortex-Analyzers.git synced 2024-11-07 09:28:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixes hashes in EmlParser

Browse Source
This commit is contained in:
Nils Kuhnert 2018-10-16 18:41:52 +02:00 committed by Jérôme Leonard
parent e3b618cbc1
commit b5e1870c5b
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
analyzers/EmlParser/parse.py
View File

@ -85,7 +85,6 @@ def parseEml(filepath):
#attachments #attachments
try: try:
for attachment in parsed_eml['attachment']: for attachment in parsed_eml['attachment']:
sha256 = hashlib.sha256()
attachmentSumUp = dict() attachmentSumUp = dict()
attachmentSumUp['filename'] = attachment.get('filename', '') attachmentSumUp['filename'] = attachment.get('filename', '')
@ -94,8 +93,9 @@ def parseEml(filepath):
#it has to be calculated, the attachment is in base64 #it has to be calculated, the attachment is in base64
attachmentSumUp['mime'] = magic.from_buffer(binascii.a2b_base64(attachment['raw'])) attachmentSumUp['mime'] = magic.from_buffer(binascii.a2b_base64(attachment['raw']))
attachmentSumUp['extension'] = attachment.get('extension', '') attachmentSumUp['extension'] = attachment.get('extension', '')
sha256.update(attachment['raw']) attachmentSumUp['md5'] = attachment['hash']['md5']
attachmentSumUp['sha256'] = sha256.hexdigest() attachmentSumUp['sha1'] = attachment['hash']['sha1']
attachmentSumUp['sha256'] = attachment['hash']['sha256']
result['attachments'].append(attachmentSumUp) result['attachments'].append(attachmentSumUp)
except KeyError as e: except KeyError as e:

8
thehive-templates/EmlParser_1_0/long.html
View File

@ -52,7 +52,13 @@
</thead> </thead>
<tbody ng-repeat="a in content.attachments"> <tbody ng-repeat="a in content.attachments">
<tr> <tr>
<td rowspan=2>{{a.filename}}</td> <td rowspan=3>{{a.filename}}</td>
<td>[MD5]: {{a.md5}}</td>
</tr>
<tr>
<td>[SHA1]: {{a.sha1}}</td>
</tr>
<tr>
<td>[SHA256]: {{a.sha256}}</td> <td>[SHA256]: {{a.sha256}}</td>
</tr> </tr>
<tr> <tr>