-
Notifications
You must be signed in to change notification settings - Fork 157
Description
Right now, we use the file name as is with some minor sanitization performed by drakrun.analyzer.startup_command.get_target_filename_from_sample_path.
If we upload file with a name that is just a hash (29611...f0), it will be uploaded to the VM with that name. As we know, extensions are important thing on Windows and without it, we may not guess the proper way to start the process.
Previously Drakvuf Sandbox tried pretty hard to find a good entrypoint based on extension, libmagic output and various file parsers. I would prefer to be able to provide a proper entrypoint rather than relying on how smart the entrypoint detector is (in some cases it failed terribly and simple cmd.exe /C start <file> was enough). That's why it would be better to rework that feature rather than improve the previous code.