Package lib :: Package core :: Module packages
[hide private]
[frames] | no frames]

Source Code for Module lib.core.packages

 1  # Copyright (C) 2010-2015 Cuckoo Foundation. 
 2  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org 
 3  # See the file 'docs/LICENSE' for copying permission. 
 4   
5 -def choose_package(file_type, file_name):
6 """Choose analysis package due to file type and file extension. 7 @param file_type: file type. 8 @param file_name: file name. 9 @return: package name or None. 10 """ 11 if not file_type: 12 return None 13 14 file_name = file_name.lower() 15 16 if "DLL" in file_type: 17 if file_name.endswith(".cpl"): 18 return "cpl" 19 else: 20 return "dll" 21 elif "PE32" in file_type or "MS-DOS" in file_type: 22 return "exe" 23 elif "PDF" in file_type or file_name.endswith(".pdf"): 24 return "pdf" 25 elif "Rich Text Format" in file_type or \ 26 "Microsoft Word" in file_type or \ 27 "Microsoft Office Word" in file_type or \ 28 file_name.endswith((".doc", ".docx", ".rtf")): 29 return "doc" 30 elif "Microsoft Office Excel" in file_type or \ 31 "Microsoft Excel" in file_type or \ 32 file_name.endswith((".xls", ".xlsx")): 33 return "xls" 34 elif "Microsoft PowerPoint" in file_type or \ 35 file_name.endswith((".ppt", ".pptx", ".pps", ".ppsx", ".pptm", ".potm", ".potx", ".ppsm")): 36 return "ppt" 37 elif "HTML" in file_type or file_name.endswith((".htm", ".html")): 38 return "html" 39 elif file_name.endswith(".jar"): 40 return "jar" 41 elif "Zip" in file_type: 42 return "zip" 43 elif file_name.endswith((".py", ".pyc")) or "Python script" in file_type: 44 return "python" 45 elif file_name.endswith(".vbs"): 46 return "vbs" 47 elif file_name.endswith(".msi"): 48 return "msi" 49 else: 50 return "generic"
51