spender-sandbox / cuckoo-modified

Modified edition of cuckoo

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

MD5 hash of the samples changes in the report file.

masifpak opened this issue · comments

Hi,

I have submitted the file to the cuckoo, the name of the file was its md5 hash. when I see the report of specific task on django dashboard it is same as the name of the file as well as it stored in sample table of cuckoo database.
But when I searched the same md5 hash in its json report it only shows it in the name that is target.file.name but I was expecting that the md5 hash at target.file.md5 but its different.

example:

  1. The file name was 79be5bbda1bff8a3464d81780b829899.

  2. The MD5 hash on the dashboard and database remain same as 79be5bbda1bff8a3464d81780b829899`

  3. But the md5 hash in the json file at the target.file.md5 key was changed to 3c0e1d478d31aebd5ed77195a0de0bbd .

And if I just change the name of the file it changes the md5 hash in the report as well that is terrible.

What's the problem how cuckoo is calculating the hash ?