search

brad-sp / cuckoo-modified

Modified edition of cuckoo
271 stars 100 forks source link

docx signatures #234

Closed lunachy closed 8 years ago

lunachy commented 9 years ago

when analyze a normal docx, cuckoo always reports 'injection_rwx', 'antisandbox_unhook', 'recon_programs' signatures, is this accurate? regards PS: office version: office 2007 and enable all macros

KillerInstinct commented 9 years ago

I get these false positives in office 2010 also. There have been a few discussions in IRC about the unhook FPs. Likely will need to add a whitelist for the recon_programs and injection_rwx signatures.

brad-sp commented 8 years ago

These should all be fixed now.

-Brad