{"action":"created","issue":{"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/458","repository_url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified","labels_url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/458/labels{/name}","comments_url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/458/comments","events_url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/458/events","html_url":"https://github.com/spender-sandbox/cuckoo-modified/issues/458","id":232854314,"number":458,"title":"wrong package ppsx - opened in doc","user":{"login":"mallorybobalice","id":5554485,"avatar_url":"https://avatars1.githubusercontent.com/u/5554485?v=3","gravatar_id":"","url":"https://api.github.com/users/mallorybobalice","html_url":"https://github.com/mallorybobalice","followers_url":"https://api.github.com/users/mallorybobalice/followers","following_url":"https://api.github.com/users/mallorybobalice/following{/other_user}","gists_url":"https://api.github.com/users/mallorybobalice/gists{/gist_id}","starred_url":"https://api.github.com/users/mallorybobalice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mallorybobalice/subscriptions","organizations_url":"https://api.github.com/users/mallorybobalice/orgs","repos_url":"https://api.github.com/users/mallorybobalice/repos","events_url":"https://api.github.com/users/mallorybobalice/events{/privacy}","received_events_url":"https://api.github.com/users/mallorybobalice/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2017-06-01T11:52:56Z","updated_at":"2017-06-05T12:01:46Z","closed_at":null,"body":"tldr - this https://www.hybrid-analysis.com/sample/796a386b43f12b99568f55166e339fcf43a4792d292bdd05dafa97ee32518921?environmentId=100 isn't good \r\n\r\nthe correct package is powerpoint ppt not doc\r\nalso, when opened it still won't autorun, until mouseovered in interactive analysis mode by human person. \r\n\r\nthoughts?\r\n@doomedraven \r\n"},"comment":{"url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/comments/306171306","html_url":"https://github.com/spender-sandbox/cuckoo-modified/issues/458#issuecomment-306171306","issue_url":"https://api.github.com/repos/spender-sandbox/cuckoo-modified/issues/458","id":306171306,"user":{"login":"mallorybobalice","id":5554485,"avatar_url":"https://avatars1.githubusercontent.com/u/5554485?v=3","gravatar_id":"","url":"https://api.github.com/users/mallorybobalice","html_url":"https://github.com/mallorybobalice","followers_url":"https://api.github.com/users/mallorybobalice/followers","following_url":"https://api.github.com/users/mallorybobalice/following{/other_user}","gists_url":"https://api.github.com/users/mallorybobalice/gists{/gist_id}","starred_url":"https://api.github.com/users/mallorybobalice/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mallorybobalice/subscriptions","organizations_url":"https://api.github.com/users/mallorybobalice/orgs","repos_url":"https://api.github.com/users/mallorybobalice/repos","events_url":"https://api.github.com/users/mallorybobalice/events{/privacy}","received_events_url":"https://api.github.com/users/mallorybobalice/received_events","type":"User","site_admin":false},"created_at":"2017-06-05T12:01:46Z","updated_at":"2017-06-05T12:01:46Z","body":"Thanks \r\n\r\nHmm doesn't look like Just adding ppsx to \r\nelif \"Microsoft PowerPoint\" in file_type or \\            file_name.endswith((\".ppt\", \".pot\", \".pps\", \".pptx\", \".pptm\", \".potx\", \".potm\", \".ppam\", \".ppsx\", \".ppsm\", \".sldx\", \".sldm\")):        return \"ppt\"\r\n\r\nWill help.\r\n\r\nSeems like the least harmful way is taking 'Microsoft ooxml ' out of the doc if and moving it into elseif after PowerPoint, but still bound to doc? \r\nelif \"Rich Text Format\" in file_type or \\            \"Microsoft Word\" in file_type or \\            \"Microsoft Office Word\" in file_type or \\            \"Microsoft OOXML\" in file_type or \\            \"MIME entity\" in file_type or \\            file_name.endswith((\".doc\", \".dot\", \".docx\", \".dotx\", \".docm\", \".dotm\", \".docb\", \".rtf\", \".mht\", \".mso\")):        return \"doc\"\r\n\r\n\r\nThis is the easy bit. \r\nFor running it, Short of xml decoding all the relationship  targets out of xml.rels I can't think of anything. Either blindly or after matching to action ppaction:program. \r\n\r\nI haven't looked what we can do for ole in the other issue. I would mind blindly extract and run "}}
{"actor":{"display_login":"mallorybobalice"}}