cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.57k stars 1.71k forks source link

TypeError: exception() got an unexpected keyword argument 'extra' #1807

Closed k1rk1r closed 6 years ago

k1rk1r commented 7 years ago

Hello,

When I submit a sample the analysis process works fine, but after each successfully completed analysis I get the following exception. In the following, I copy & paste the whole output:

k1rk1r@k1rk1r:~$ cuckoo

                                 _|
     _|_|_|  _|    _|    _|_|_|  _|  _|      _|_|      _|_|
   _|        _|    _|  _|        _|_|      _|    _|  _|    _|
   _|        _|    _|  _|        _|  _|    _|    _|  _|    _|
     _|_|_|    _|_|_|    _|_|_|  _|    _|    _|_|      _|_|

 Cuckoo Sandbox 2.0.3
 www.cuckoosandbox.org
 Copyright (c) 2010-2017

 Checking for updates...
 You're good to go!
2017-08-27 15:09:56,971 [cuckoo] WARNING: It appears that you haven't loaded any Cuckoo Signatures. Signatures are highly recommended and improve & enrich the information extracted during an analysis. They also make up for the analysis score that you see in the Web Interface - so, pretty important!
2017-08-27 15:09:56,971 [cuckoo] WARNING: You'll be able to fetch all the latest Cuckoo Signaturs, Yara rules, and more goodies by running the following command:
2017-08-27 15:09:56,972 [cuckoo] INFO: $ cuckoo community
2017-08-27 15:09:56,974 [cuckoo.core.scheduler] INFO: Using "virtualbox" as machine manager
2017-08-27 15:09:59,039 [cuckoo.core.scheduler] INFO: Loaded 1 machine/s
2017-08-27 15:09:59,059 [cuckoo.core.scheduler] INFO: Waiting for analysis tasks.
2017-08-27 15:10:44,875 [cuckoo.core.scheduler] INFO: Starting analysis of FILE "b48dea670abb434ef50b76dcde4a906cb541c49abd2112782548103b13f5889d.exe" (task #30, options "")
2017-08-27 15:10:45,090 [cuckoo.core.scheduler] INFO: Task #30: acquired machine cuckoo1 (label=WIndows-Cuckoo)
2017-08-27 15:10:45,103 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3701 (interface=vboxnet0, host=192.168.56.101, pcap=/home/k1rk1r/.cuckoo/storage/analyses/30/dump.pcap)
2017-08-27 15:10:49,721 [cuckoo.core.guest] INFO: Starting analysis on guest (id=cuckoo1, ip=192.168.56.101)
2017-08-27 15:10:59,275 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.7 (id=cuckoo1, ip=192.168.56.101)
2017-08-27 15:13:38,552 [cuckoo.core.guest] INFO: cuckoo1: analysis completed successfully
Exception in thread Thread-4:
Traceback (most recent call last):
  File "/usr/lib/python2.7/threading.py", line 551, in __bootstrap_inner
    self.run()
  File "/usr/local/lib/python2.7/dist-packages/Cuckoo-2.0.3-py2.7.egg/cuckoo/core/scheduler.py", line 744, in run
    "status": "error",
TypeError: exception() got an unexpected keyword argument 'extra'

The VM will be started and the sample executed as expected, but after everything is done I get this exception and the VM session will not close automatically. Even when I invoke the cuckoo command as cuckoo user, I get this exception. After closing the VM via CTRL-C from command-line, I get the following:

^C2017-08-27 15:28:28,005 [cuckoo.common.abstracts] INFO: Still 1 guests alive. Shutting down...
Exception in thread Thread-3 (most likely raised during interpreter shutdown):

Note: The solution at https://github.com/cuckoosandbox/cuckoo/issues/1607 has not helped.

Host OS details: Ubuntu 12.04 (64-bit), Python 2.7.3, cuckoo sandbox v2.0.3 (all dependencies specified by official website are installed)

Guest OS details: Windows XP SP3, MS Office 2003, Adobe Reader 9.5 etc.

I hope someone can help.

Best regards :)

doomedraven commented 7 years ago

why do you run that on so old ubuntu os?

jbremer commented 7 years ago

Not sure what's going on here. If I manually make sure I get an exception in that function and therefore the logging is reached, I don't get said error logging above, but instead properly filled out logs. I suspect that your older version of Python ships an older version of the logging Python stdlib library. Upgrading your OS would probably be wise.

jbremer commented 7 years ago

Any update @k1rk1r?

jbremer commented 6 years ago

Closing issue for lack of additional information. Although note that this is most likely related to the outdated version of Python. Please reopen if you have more feedback. Thanks!