search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.53k stars 1.7k forks source link

Failed to run the processing module "Static" for task #4: #3112

Open uaalexx opened 3 years ago

uaalexx commented 3 years ago

hi there!

After analyzing the file, I get this error in report

My Cuckoo version is 2.0.7 operating system Ubuntu 20.04.1

2020-09-28 16:38:16,949 [cuckoo.core.scheduler] INFO: Task #4: acquired machine ho-pc54321 (label=ho-pc54321) 2020-09-28 16:38:16,950 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.56.101 for task #4 2020-09-28 16:38:16,951 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Replay 2020-09-28 16:38:16,958 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 652001 (interface=vboxnet0, host=192.168.56.101) 2020-09-28 16:38:16,959 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer 2020-09-28 16:38:17,156 [cuckoo.machinery.virtualbox] DEBUG: Starting vm ho-pc54321 2020-09-28 16:38:17,332 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine ho-pc54321 to ho-pc54321_Snap01 2020-09-28 16:38:23,198 [cuckoo.core.guest] INFO: Starting analysis #4 on guest (id=ho-pc54321, ip=192.168.56.101) 2020-09-28 16:38:24,201 [cuckoo.core.guest] DEBUG: ho-pc54321: not ready yet 2020-09-28 16:38:25,205 [cuckoo.core.guest] DEBUG: ho-pc54321: not ready yet 2020-09-28 16:38:25,212 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=ho-pc54321, ip=192.168.56.101) 2020-09-28 16:38:25,231 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=ho-pc54321, ip=192.168.56.101, monitor=latest, size=3884763) 2020-09-28 16:38:25,980 [cuckoo.core.resultserver] DEBUG: Task #4: live log analysis.log initialized. 2020-09-28 16:38:30,612 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:38:33,009 [cuckoo.core.resultserver] DEBUG: Task #4 is sending a BSON stream 2020-09-28 16:38:34,244 [cuckoo.core.resultserver] DEBUG: Task #4 is sending a BSON stream 2020-09-28 16:38:34,812 [cuckoo.core.resultserver] DEBUG: Task #4: File upload for 'shots/0001.jpg' 2020-09-28 16:38:34,820 [cuckoo.core.resultserver] DEBUG: Task #4 uploaded file length: 47898 2020-09-28 16:38:35,645 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:38:35,837 [cuckoo.core.resultserver] DEBUG: Task #4: File upload for 'shots/0002.jpg' 2020-09-28 16:38:35,848 [cuckoo.core.resultserver] DEBUG: Task #4 uploaded file length: 79793 2020-09-28 16:38:40,683 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:38:45,715 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:38:50,745 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:38:55,775 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:00,809 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:05,840 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:10,886 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:15,917 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:20,947 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:25,984 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:31,020 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:36,056 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:41,093 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:46,122 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:51,152 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:39:56,183 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:01,220 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:06,256 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:11,286 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:16,317 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:21,345 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:26,382 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:31,414 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:35,834 [cuckoo.core.resultserver] DEBUG: Task #4: File upload for 'memory/556-1.dmp' 2020-09-28 16:40:36,446 [cuckoo.core.guest] DEBUG: ho-pc54321: analysis #4 still processing 2020-09-28 16:40:36,855 [cuckoo.core.resultserver] DEBUG: Task #4 uploaded file length: 48613928 2020-09-28 16:40:37,450 [cuckoo.core.guest] INFO: ho-pc54321: analysis completed successfully 2020-09-28 16:40:37,461 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Replay 2020-09-28 16:40:37,500 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2020-09-28 16:41:02,231 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label ho-pc54321 to path /opt/cuckoo/storage/analyses/4/memory.dmp 2020-09-28 16:41:02,231 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm ho-pc54321 2020-09-28 16:41:05,157 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.56.101 for task #4 2020-09-28 16:41:05,159 [cuckoo.core.resultserver] DEBUG: Cancel for task 4 2020-09-28 16:41:05,353 [cuckoo.core.scheduler] DEBUG: Released database task #4 2020-09-28 16:41:05,783 [cuckoo.core.plugins] DEBUG: Executed processing module "AnalysisInfo" for task #4 2020-09-28 16:41:05,797 [cuckoo.core.plugins] DEBUG: Executed processing module "BehaviorAnalysis" for task #4 2020-09-28 16:41:05,797 [cuckoo.core.plugins] DEBUG: Executed processing module "Dropped" for task #4 2020-09-28 16:41:05,797 [cuckoo.core.plugins] DEBUG: Executed processing module "DroppedBuffer" for task #4 2020-09-28 16:41:05,798 [cuckoo.processing.memory] ERROR: Cannot run volatility module: the volatility library is not available. Please install it according to their documentation. 2020-09-28 16:41:05,798 [cuckoo.core.plugins] DEBUG: Executed processing module "Memory" for task #4 2020-09-28 16:41:06,345 [cuckoo.core.plugins] DEBUG: Executed processing module "MetaInfo" for task #4 2020-09-28 16:41:06,345 [cuckoo.core.plugins] DEBUG: Executed processing module "Procmon" for task #4 2020-09-28 16:41:06,399 [cuckoo.core.plugins] DEBUG: Executed processing module "Screenshots" for task #4 2020-09-28 16:41:06,770 [cuckoo.core.plugins] ERROR: Failed to run the processing module "Static" for task #4: Traceback (most recent call last): File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/plugins.py", line 246, in process data = current.run() File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 1075, in run static.update(PortableExecutable(f.file_path).run()) File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 317, in run results["signature"] = self._get_signature() File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 281, in _get_signature "email": subject.Email, File "/usr/local/lib/python2.7/dist-packages/M2Crypto/X509.py", line 317, in getattr return six.ensure_text(m2.x509_name_by_nid(self.x509_name, self.nid[attr])) File "/usr/local/lib/python2.7/dist-packages/M2Crypto/six.py", line 906, in ensure_text raise TypeError("not expecting type '%s'" % type(s)) TypeError: not expecting type '<type 'NoneType'>' 2020-09-28 16:41:07,189 [cuckoo.core.plugins] DEBUG: Executed processing module "Strings" for task #4 2020-09-28 16:41:07,208 [cuckoo.core.plugins] DEBUG: Executed processing module "TargetInfo" for task #4 2020-09-28 16:41:07,224 [cuckoo.core.plugins] DEBUG: Executed processing module "NetworkAnalysis" for task #4 2020-09-28 16:41:07,225 [cuckoo.core.plugins] DEBUG: Executed processing module "Extracted" for task #4 2020-09-28 16:41:07,225 [cuckoo.core.plugins] DEBUG: Executed processing module "TLSMasterSecrets" for task #4 2020-09-28 16:41:07,961 [cuckoo.core.plugins] DEBUG: Executed processing module "Debug" for task #4 2020-09-28 16:41:07,986 [cuckoo.core.plugins] DEBUG: Running 542 signatures 2020-09-28 16:41:08,142 [cuckoo.core.plugins] DEBUG: Analysis

doomedraven commented 3 years ago

that isn't cuckoo problem, is six library problem, google it, or just upgrade six library

nunofranciscomoreira commented 3 years ago

that isn't cuckoo problem, is six library problem, google it, or just upgrade six library

you sure about that? If you check the six.py code you'll see that the problem is that the string that is being passed is None. So, the caller of six.py, must be the source of this problem.

nunofranciscomoreira commented 3 years ago

What I did to fix it was comment out the raise expression on the 3 segments. Works like a charm now ;)