Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Method to identify an incomplete CAPE report #2035

Closed
Iroxious opened this issue Mar 24, 2024 · 5 comments · Fixed by #2042
Closed

Method to identify an incomplete CAPE report #2035

Iroxious opened this issue Mar 24, 2024 · 5 comments · Fixed by #2042

Comments

@Iroxious
Copy link

Hello, thank you for reading this issue.
I am currently using an unofficial version of CAPE, which seems to cause some fields to be missing in the CAPE reports. CAPA is unable to recognize these reports, resulting in the following error message:

D:\Study\capa-v7.0.1-windows>capa D:\Study\analyses\jsons\2496_reports_report.json -d
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa: Using default embedded rules.
DEBUG:capa: To provide your own rules, use the form capa.exe -r ./path/to/rules/ /path/to/mal.exe.
DEBUG:capa: You can see the current default rule set here:
DEBUG:capa: https://github.com/mandiant/capa-rules
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa: Using default embedded signatures.
DEBUG:capa: To provide your own signatures, use the form capa.exe --signature ./path/to/signatures/ /path/to/mal.exe.
DEBUG:capa:--------------------------------------------------------------------------------
DEBUG:capa.rules:reading rules from directory C:\Users\DavidLee\AppData\Local\Temp_MEI336362\rules
DEBUG:capa.rules.cache:loading rule set from cache: C:\Users\DavidLee\AppData\Local\Temp_MEI336362\cache\capa-d2f2a22b.cache
DEBUG:capa:successfully loaded 866 rules
Traceback (most recent call last):
File "main.py", line 944, in
File "main.py", line 806, in main
File "main.py", line 643, in get_file_extractors_from_cli
File "loader.py", line 291, in get_file_extractors
File "features\extractors\cape\extractor.py", line 126, in from_report
File "pydantic\main.py", line 503, in model_validate
pydantic_core._pydantic_core.ValidationError: 3 validation errors for CapeReport
target.file.sha3_384
Field required [type=missing, input_value={'name': '5ceb25d26af3df6...: '2008-07-28 08:11:35'}, input_type=dict]
For further information visit https://errors.pydantic.dev/2.4/v/missing
CAPE
Input should be a valid dictionary or instance of Cape [type=model_type, input_value=[], input_type=list]
For further information visit https://errors.pydantic.dev/2.4/v/model_type
dropped.0.sha3_384
Field required [type=missing, input_value={'name': 'msupdate.exe', ...al\Temp\msupdate.exe'}, input_type=dict]
For further information visit https://errors.pydantic.dev/2.4/v/missing
[28876] Failed to execute script 'main' due to unhandled exception!

Could you kindly suggest a method for batch processing these reports to ensure compatibility with CAPA?
The JSON report generated by CAPE has been attached.
2496_reports_report.json
Thank you for your attention.

@Iroxious Iroxious changed the title How to identify an incomplete CAPE report Method to identify an incomplete CAPE report Mar 24, 2024
@mr-tz
Copy link
Collaborator

mr-tz commented Mar 24, 2024

You can try to mark sha3_384 optional here:

I can take a closer look next week.

@mr-tz mr-tz mentioned this issue Mar 26, 2024
3 tasks
@mr-tz
Copy link
Collaborator

mr-tz commented Mar 26, 2024

@Iroxious, please check if #2042 fixes this for you.

@Iroxious
Copy link
Author

@Iroxious, please check if #2042 fixes this for you.

It worked! Thank you very much for your assistance!

@mr-tz
Copy link
Collaborator

mr-tz commented Apr 9, 2024

@Iroxious, can you provide an excerpt how the CAPE data looks like when it's not an empty list?

@Iroxious
Copy link
Author

I'm sorry, I cannot determine the type of the non-empty value of the CAPE field. Due to time constraints and configuration environment reasons, we are currently unable to directly use the official CAPE code.
The previous speculation that the version of CAPE might affect the field values was somewhat arbitrary, as there is also a possibility that using the official CAPE code may result in such empty values, but we are temporarily unable to ascertain.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants