Merge pull request #2 from YungBinary/main

Lumma - Handle PEs that don't have rdata section
CAPESandbox · Nov 12, 2024 · a8e4ac3 · a8e4ac3
2 parents 506bee7 + bb6f353
commit a8e4ac3
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/cape_parsers/CAPE/community/Lumma.py b/cape_parsers/CAPE/community/Lumma.py
@@ -71,10 +71,14 @@ def extract_config(data):
     # try with newer version xor decoding
     if not config_dict["C2"]:
         try:
+
             rdata = get_rdata(data)
-            strings = extract_strings(rdata, 44)
-            base64_strings = get_base64_strings(strings)
+            if rdata is not None:
+                strings = extract_strings(rdata, 44)
+            else:
+                strings = extract_strings(data, 44)
 
+            base64_strings = get_base64_strings(strings)
             for base64_str in base64_strings:
                 try:
                     decoded_bytes = base64.b64decode(base64_str, validate=True)