1
2
3
4
5 import os
6
7 from lib.common.abstracts import Package
8 from lib.api.process import Process
9 from lib.common.exceptions import CuckooPackageError
10
11
13 """Internet Explorer analysis package."""
14
16 free = self.options.get("free", False)
17 dll = self.options.get("dll", None)
18 suspended = True
19 if free:
20 suspended = False
21
22 iexplore = os.path.join(os.getenv("ProgramFiles"), "Internet Explorer", "iexplore.exe")
23
24 p = Process()
25 if not p.execute(path=iexplore, args="\"%s\"" % url, suspended=suspended):
26 raise CuckooPackageError("Unable to execute initial Internet "
27 "Explorer process, analysis aborted")
28
29 if not free and suspended:
30 p.inject(dll)
31 p.resume()
32 return p.pid
33 else:
34 return None
35
38
40 if self.options.get("procmemdump", False):
41 for pid in self.pids:
42 p = Process(pid=pid)
43 p.dump_memory()
44
45 return True
46