nukib / maldump Goto Github PK

Hello !

I'm very interested at this project !
I would like to make an executable using Pyinstaller in order to forensically extract quarantines files on computers without Python installed.
Do you think it is possible ?

Thank you so much !

Describe the bug
In newest version 0.3.0 maldump can not find module maldump.parsers.kaitai. Version 0.2.0 does not have this problem. I have kaitaistruct installed.

To Reproduce
Steps to reproduce the behavior:

1. pip install maldump
2. Run any maldump command
3. Stack Trace
   Traceback (most recent call last):
   File "<frozen runpy>", line 198, in run_module_as_main
   File "<frozen runpy>", line 88, in run_code
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Scripts\maldump.exe_main.py", line 4, in <module>
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump_main.py", line 17, in <module>
   from maldump.av_manager import AVManager
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\av_manager.py", line 5, in <module>
   from maldump.avs import (avast, avg, avira, eset, forticlient, gdata,
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\avs\avira.py", line 6, in <module>
   from maldump.parsers.avira_parser import AviraParser
   File "C:\Users\username\AppData\Local\Programs\Python\Python312\Lib\site-packages\maldump\parsers\avira_parser.py", line 5, in <module>
   from maldump.parsers.kaitai.avira_parser import AviraParser as KaitaiParser
   ModuleNotFoundError: No module named 'maldump.parsers.kaitai'

Expected behavior
No errors.

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• OS: Windows

Is your feature request related to a problem? Please describe.
After the tool is used, it would be nice to get info such as folders scanned, number of found logs, etc. This would help with possible issues and, in general, better info about what is happening.

Describe the solution you'd like
There would be some summary line with relevant information so analysts can see what was touched by Maldump and what the results were. E.g. scanned folders: 3 Relevant log files: 10/1000.

Describe alternatives you've considered
Add this as an optional argument "-v".

Additional context
During testing of the tool, no relevant info was displayed (when nothing was found) so it would be nice to make it more interactive.