.ARRAY file ending about peekabooav HOT 7 CLOSED

Hi Michael,

this is a know bug in our internal bug tracker. We're working on it.

Under circumstances the data structure we dump from amavis (with the patch) holds an array rather than a single value for the data field we extract the file extension from.

This passed to Cuckoo and run inside the VM makes Windows open the dialog for which application you want to open this file with which queries for the hostname which then is detected by Cuckoo, reported, and interpreted as malicious by Peekaboo for some file types.

Like I said I'm currently working on it and testing the improved amavis patch. We might be able to update the repository this week no promise though ;-)

Best
Felix

from peekabooav.

That relieves me! I just saw right now there might also be a Problem with *.gif files. But i'm not sure..
I'm really looking forward to the update :)

from peekabooav.

Hi Felix,
With your newest amavis-patch, .ARRAY-files aren't displayed in the cuckoo web-interface anymore.
Only thing is, postfix can't handle incoming mails. See following error:
(host 127.0.0.1[127.0.0.1] said: 451 4.5.0 Error in processing, id=16872-01, parts_decode_ext FAILED: Insecure dependency in printf while running with -T switch at (eval 118) line 309. (in reply to end of DATA command))
Amavis then creates a file in /tmp/ARRAY_0x52884c0. This file then cannot be uploaded to cuckoo.

Best
Michael

from peekabooav.

Hi Michael,
just a quick update on our amavis patch. We recently published our patched version of amavis in a separate repository on GitHub to avoid further issues with multiple non-working patches.
https://github.com/scVENUS/PeekabooAV-amavisd
We are integrating our own amavis into the PeekabooAV installer soon.

Cheers,
Sebastian

from peekabooav.

The file /tmp/ARRAY_0x52884c0 is debug output and only created if the filename contains a blank space. It is not meant to be analyzed by Cuckoo.
However, it has been removed, since it wasn't meant to be part of the productive patch.

from peekabooav.

Hi Sebastian
thank you for your information. I'm going test the patched version in a few days and will inform you.

Best,
Michael

from peekabooav.

New Patch is working perfectly.

from peekabooav.