1
2
3
4
5
6 import json
7 import os
8
9 from lib.cuckoo.common.abstracts import Processing
10 from lib.cuckoo.common.objects import File
11
13 """Dropped files analysis."""
14
16 """Run analysis.
17 @return: list of dropped files with related information.
18 """
19 self.key = "dropped"
20 dropped_files, meta = [], {}
21
22 if os.path.exists(self.dropped_meta_path):
23 for line in open(self.dropped_meta_path, "rb"):
24 entry = json.loads(line)
25 filepath = os.path.join(self.analysis_path, entry["path"])
26 meta[filepath] = {
27 "pids": entry["pids"],
28 "filepath": entry["filepath"],
29 }
30
31 for dir_name, dir_names, file_names in os.walk(self.dropped_path):
32 for file_name in file_names:
33 file_path = os.path.join(dir_name, file_name)
34 file_info = File(file_path=file_path).get_all()
35 file_info.update(meta.get(file_info["path"], {}))
36 dropped_files.append(file_info)
37
38 for dir_name, dir_names, file_names in os.walk(self.package_files):
39 for file_name in file_names:
40 file_path = os.path.join(dir_name, file_name)
41 file_info = File(file_path=file_path).get_all()
42 dropped_files.append(file_info)
43
44 return dropped_files
45