diff --git a/misp_modules/modules/import_mod/joe_import.py b/misp_modules/modules/import_mod/joe_import.py index 0d22074..8f258cd 100644 --- a/misp_modules/modules/import_mod/joe_import.py +++ b/misp_modules/modules/import_mod/joe_import.py @@ -168,6 +168,10 @@ class JoeParser(): def parse_fileactivities(self, process_uuid, fileactivities): for feature, files in fileactivities.items(): + # ignore unknown features + if feature not in file_references_mapping: + continue + if files: for call in files['call']: self.attributes['filename'][call['path']].add((process_uuid, file_references_mapping[feature])) @@ -198,7 +202,8 @@ class JoeParser(): name = feature['name'] if name == 'InternalName': program_name = feature['value'] - pe_object.add_attribute(pe_object_mapping[name], **{'type': 'text', 'value': feature['value']}) + if name in pe_object_mapping: + pe_object.add_attribute(pe_object_mapping[name], **{'type': 'text', 'value': feature['value']}) sections_number = len(peinfo['sections']['section']) pe_object.add_attribute('number-sections', **{'type': 'counter', 'value': sections_number}) signatureinfo = peinfo['signature']