cuckoosandbox / community

Repository of modules and signatures contributed by the community
323 stars 175 forks source link

creates_doc signature is always hit when .doc file is submitted #472

Closed cccs-kevin closed 4 years ago

cccs-kevin commented 4 years ago

When a doc file is submitted, the creates_doc signature is always raised because the signature only looks for if a (doc|docm|dotm|docx|ppt|pptm|pptx|potm|ppam|ppsm|xls|xlsm|xlsx|pdf) file is written to the file system, not to see if the file submitted created a new file of one of these types. The submitted file should be whitelisted from this check.