spender-sandbox / cuckoo-modified

Modified edition of cuckoo
393 stars 178 forks source link

MD5 hash of the samples changes in the report file. #481

Open masifpak opened 7 years ago

masifpak commented 7 years ago

Hi,

I have submitted the file to the cuckoo, the name of the file was its md5 hash. when I see the report of specific task on django dashboard it is same as the name of the file as well as it stored in sample table of cuckoo database. But when I searched the same md5 hash in its json report it only shows it in the name that is target.file.name but I was expecting that the md5 hash at target.file.md5 but its different.

example:

  1. The file name was 79be5bbda1bff8a3464d81780b829899.

  2. The MD5 hash on the dashboard and database remain same as 79be5bbda1bff8a3464d81780b829899`

  3. But the md5 hash in the json file at the target.file.md5 key was changed to 3c0e1d478d31aebd5ed77195a0de0bbd .

And if I just change the name of the file it changes the md5 hash in the report as well that is terrible.

What's the problem how cuckoo is calculating the hash ?