-
Notifications
You must be signed in to change notification settings - Fork 616
Closed
Description
Description
While running capa 7.3.0 on a VMRay analysis archive, capa crashed and provided a stack trace for troubleshooting.
Steps to Reproduce
- Obtain VMRay sample archive for sample
2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4
(attached) - Run
./capa -d -f vmray 2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4_analysis_archive.zip
- Observe output
Expected behavior:
I expected a capability report.
Actual behavior:
The capa process crashed with stack trace:
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa: Using default embedded rules.
DEBUG:capa: To provide your own rules, use the form:
DEBUG:capa:
DEBUG:capa: `capa.exe -r ./path/to/rules/ /path/to/mal.exe`.
DEBUG:capa:
DEBUG:capa: You can see the current default rule set here:
DEBUG:capa:
DEBUG:capa: https://github.com/mandiant/capa-rules
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa.rules:reading rules from directory /tmp/_MEIoxSNmT/rules
DEBUG:capa.rules.cache:loading rule set from cache: /tmp/_MEIoxSNmT/cache/capa-df400217.cache
DEBUG:capa:successfully loaded 901 rules
DEBUG:capa.features.extractors.vmray:file_type: Windows Exe (x86-32), file_path: internal/static_analyses/2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4/objects/files/2f8a7
9b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4
Traceback (most recent call last):
File "main.py", line 1094, in <module>
File "main.py", line 956, in main
File "main.py", line 708, in get_file_extractors_from_cli
File "loader.py", line 390, in get_file_extractors
File "features/extractors/vmray/extractor.py", line 122, in from_zipfile
File "features/extractors/vmray/__init__.py", line 87, in __init__
File "features/extractors/vmray/__init__.py", line 141, in _compute_process_threads
File "features/extractors/vmray/__init__.py", line 161, in get_process_os_pid
KeyError: 3
[PYI-1584:ERROR] Failed to execute script 'main' due to unhandled exception!
Versions
capa 7.3.0
5.15.0-1047-aws 20.04.1-Ubuntu x86_64
Additional Information
See attached analysis archive for troubleshooting
2f8a79b12a7a989ac7e5f6ec65050036588a92e65aeb6841e08dc228ff0e21b4_analysis_archive.zip
Metadata
Metadata
Assignees
Labels
No labels