Fixed VT section MD5 search query string (#8)

* Initial commit * Rekall integration * Updated README.md * Fixed VT section MD5 query Co-authored-by: Tom Bonner <[email protected]>
blackberry · Oct 5, 2020 · 531bc7d · 531bc7d
1 parent 5679cb6
commit 531bc7d
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.0.29](/../tags/1.0.29) - 2020-10-05
+
+### Fixed
+
+- Fixed section MD5 VT search query
+
 ## [1.0.28](/../tags/1.0.28) - 2020-10-02
 
 ### Added

diff --git a/pe_tree/info.py b/pe_tree/info.py
@@ -20,7 +20,7 @@
 
 __author__ = "Tom Bonner"
 __copyright__ = "Copyright © 2020 BlackBerry Limited."
-__version__ = "1.0.28"
+__version__ = "1.0.29"
 __maintainer__ = "Tom Bonner"
 __email__ = "[email protected]"
 __license__ = "Apache License 2.0"

diff --git a/pe_tree/tree.py b/pe_tree/tree.py
@@ -494,7 +494,7 @@ def run(self):
 
                     section_item.appendRow([pe_tree.qstandarditems.PEFileItem(self, name="Entropy"), pe_tree.qstandarditems.EntropyItem(self, section_hashes["entropy"])])
                     section_item.appendRow([pe_tree.qstandarditems.PEFileItem(self, name="SHA256"), pe_tree.qstandarditems.PEFileItem(self, name=section_hashes["sha256"])])
-                    section_item.appendRow([pe_tree.qstandarditems.PEFileItem(self, name="MD5"), pe_tree.qstandarditems.PEFileItem(self, name=section_hashes["md5"], vt_query="section:\"{}\"")])
+                    section_item.appendRow([pe_tree.qstandarditems.PEFileItem(self, name="MD5"), pe_tree.qstandarditems.PEFileItem(self, name=section_hashes["md5"], vt_query="sectionmd5:\"{}\"")])
                     section_item.appendRow([pe_tree.qstandarditems.PEFileItem(self, name="Ratio"), pe_tree.qstandarditems.RatioItem(self, size=section.SizeOfRawData, offset=section.PointerToRawData, entropy=section_hashes["entropy"])])
 
                     sections_item.appendRow([section_item, pe_tree.qstandarditems.PEFileItem(self, name="", offset=section.VirtualAddress)])