nheijmans / malzoo

Mass static malware analysis tool
https://www.sans.org/reading-room/whitepapers/threathunting/automated-analysis-abuse-mailbox-employees-malzoo-37207
GNU General Public License v2.0
91 stars 29 forks source link

URL's from emails not getting sent to Cuckoo #5

Open philmccracken1975 opened 6 years ago

philmccracken1975 commented 6 years ago

I'm trying to utilise malzoo to get URL's and attachments from emails and run them through cuckoo. Attachments in emails work fine either singular or even better multiple but URL's don't and the debug log shows the following.

2017-10-25 14:05:04,387 - emailworker - {'sha1': '547c8063df4f73c12f5e90d7a22a4bc69b5a32b6', 'id_tag': 'malzoo', 'submit_date': 1508936704, 'msg_id': 'CA+wG9XrKrshrLJfaDUyzU=QSGHFx5MKeAuaQJddPC9HiR1-R0Q@mail.gmail.com', 'sample_type': 'attachment', 'filename': 'f8908ca9e854b7afc7cd11b74dfd4c4f', 'md5': 'f8908ca9e854b7afc7cd11b74dfd4c4f'} - local variable 'urls' referenced before assignment

And the URL doesn't get scanned in Cuckoo.

Any ideas. Cuckoo is very latest version 2.0.4 and Malzoo is latest from Github

Phil

nheijmans commented 6 years ago

Hi philmccracken1975, thanks for submitting this, I finally had time to test it and verified this behavior in the current version. I will take a look at it, it seems somewhere I have not defined the URL variable before I'm trying to store it. Let me dig into this and find the bug