#92 Ability to Add Files to Extraction

malduck/extractor/extract_manager.py

@@ -291,6 +291,7 @@ def __init__(self, parent: ExtractManager) -> None:
         self.globals: Dict[str, Any] = {}
         self.parent = parent  #: Bound ExtractManager instance
         self.family = None  #: Matched family
+        self.files = {}
 
     def on_extractor_error(
         self, exc: Exception, extractor: Extractor, method_name: str

malduck/extractor/extractor.py

@@ -2,6 +2,7 @@
 import inspect
 import logging
 from typing import List, cast
+from hashlib import sha256
 
 from ..procmem import ProcessMemory, ProcessMemoryELF, ProcessMemoryPE
 
@@ -329,6 +330,7 @@ def is_it_really_evil(self, p):
     yara_rules = ()  #: Names of Yara rules for which handle_match is called
     family = None  #: Extracted malware family, automatically added to "family" key for strong extraction methods
     overrides = []  #: Family match overrides another match e.g. citadel overrides zeus
+    files = {}
 
     def __init__(self, parent):
         self.parent = parent
@@ -352,6 +354,15 @@ def push_config(self, config):
         """
         return self.parent.push_config(config, self)
 
+    def push_file(self, data: bytes, filename=''):
+        """
+        Push file to files object
+        """
+        self.files[sha256(data).hexdigest()] = {
+            'filename': filename,
+            'data': data
+        }
+
     @property
     def matched(self):
         """
@@ -361,6 +372,14 @@ def matched(self):
         """
         return self.parent.family is not None
 
+    @property
+    def collected_files(self):
+        """
+        Shows collected files so far (useful in "final" extractors)
+        :rtype: dict
+        """
+        return self.parent.files
+
     @property
     def collected_config(self):
         """