James B. Rowe

TESTS TO DO / PROBLEMS TO FIX
-----------------------------------------------------------------
md5: 
sha1: 
sha256:
Filename: 

Extractor:  
Problem: 
-----------------------------------------------------------------
-----------------------------------------------------------------
md5: 
sha1: 
sha256:
Filename: /mnt/samples/consilience/malware/test/test-unzipped/379251974ebcd5c397f92ca45bb9620d

Extractor: CAPAExtractor 
Problem: the json output extracts a set of capabilities "without key", which they do not appear indeed in the capa <file> colored output

Capa
CAPA(
    capa_capabilities={
        'linking/runtime-linking': ['link function at runtime on Windows'], 
        '': ['create or open file', 'allocate memory', 'allocate or change RW memory', 'change memory protection', 'contain loop'], 
        'data-manipulation/encoding/xor': ['encode data using XOR'], 
        'host-interaction/process/terminate': ['terminate process'], 
        'host-interaction/file-system': ['get common file path'], 
        'host-interaction/file-system/meta': ['get file size'], 
        'host-interaction/file-system/read': ['read file via mapping'], 
        'load-code/pe': ['enumerate PE sections', 'resolve function by parsing PE exports'], 
        'linking/static/zlib': ['linked against ZLIB']
    }, 
    capa_attack_info={
        'Execution': {'Shared Modules': 'T1129'}, 
        'Defense Evasion': {'Obfuscated Files or Information': 'T1027'}, 
        'Discovery': {'File and Directory Discovery': 'T1083'}
    }, 
    capa_mbc_info={
        'File System': {'Create File': 'C0016', 'Read File': 'C0051'}, 
        'Memory': {'Allocate Memory': 'C0007', 'Change Memory Protection': 'C0008'}, 
        'Defense Evasion': {'Obfuscated Files or Information': 'E1027.m02'}, 
        'Data': {'Encode Data': 'C0026.002', 'Compression Library': 'C0060'}, 
        'Process': {'Terminate Process': 'C0018'}, 
        'Discovery': {'File and Directory Discovery': 'E1083', 'Code Discovery': 'B0046.001'}
    }
)
-----------------------------------------------------------------