fix: Testing if some fields exist before trying to import them

- Testing for pe itself, pe versions and pe signature
pull/304/head
chrisr3d 2019-05-15 22:05:03 +02:00
parent fc8a56d1d9
commit d195b554a5
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 15 additions and 10 deletions

View File

@ -85,16 +85,20 @@ class JoeParser():
for field, mapping in file_object_mapping.items():
attribute_type, object_relation = mapping
file_object.add_attribute(object_relation, **{'type': attribute_type, 'value': fileinfo[field]})
self.fileinfo_uuid = file_object.uuid
if not fileinfo.get('pe'):
self.misp_event.add_object(**file_object)
return
peinfo = fileinfo['pe']
pe_object = MISPObject('pe')
file_object.add_reference(pe_object.uuid, 'included-in')
self.misp_event.add_object(**file_object)
self.fileinfo_uuid = file_object.uuid
peinfo = fileinfo['pe']
for field, mapping in pe_object_fields.items():
attribute_type, object_relation = mapping
pe_object.add_attribute(object_relation, **{'type': attribute_type, 'value': peinfo[field]})
pe_object.add_attribute('compilation-timestamp', **{'type': 'datetime', 'value': int(peinfo['timestamp'].split()[0], 16)})
program_name = fileinfo['filename']
if peinfo['versions']:
for feature in peinfo['versions']['version']:
name = feature['name']
if name == 'InternalName':
@ -107,6 +111,7 @@ class JoeParser():
self.misp_event.add_object(**pe_object)
signerinfo_object.add_attribute('program-name', **{'type': 'text', 'value': program_name})
signatureinfo = peinfo['signature']
if signatureinfo['signed']:
for feature, mapping in signerinfo_object_mapping.items():
attribute_type, object_relation = mapping
signerinfo_object.add_attribute(object_relation, **{'type': attribute_type, 'value': signatureinfo[feature]})