Lack of documentation for format of Cuckoo Sandbox report file - need to know key names and order for parsing - sandbox

Question

My program parses a the JSON report file output from Cuckoo looking for DLLs. Unfortunately, there seems to be very little (none as far as I can see) documentation specifying which fields in the file are present, and whether they appear in a particular order; this makes scraping the documents incredibly uncertain as to whether the correct data is going to be captured.
At the moment, I parse the data between the 'pe_imports' (if it is present) and the 'peid_signatures' keys to find the DLLs, however, will the peid_signatures field always be present, and will it always directly succeed the DLLs? If there is any documentation for this, or you could point me to the right part in the Cuckoo code, please let me know :)
Thanks

Answer 1

will the peid_signatures field always be present?
It depends upon the signatures if some objects(in your case dll) matches with the defined signatures, the cuckoo will add score and signature information in the report. These signatures will not always present in json report.
If you are interested in finding the keys generated by cuckoo for its analysis report, you can find them in static.py file. Location of file
cuckoo/cuckoo/processing/static.py
def _get_peid_signatures(self):
"""Gets PEID signatures.
#return: matched signatures or None.
"""
try:
sig_path = cwd("peutils", "UserDB.TXT", private=True)
signatures = peutils.SignatureDatabase(sig_path)
return signatures.match(self.pe, ep_only=True)
except:
return None
and for results
def run(self):
"""Run analysis.
#return: analysis results dict or None.
"""
if not os.path.exists(self.file_path):
return {}
try:
self.pe = pefile.PE(self.file_path)
except pefile.PEFormatError:
return {}
results = {}
results["peid_signatures"] = self._get_peid_signatures()
results["pe_imports"] = self._get_imported_symbols()
results["pe_exports"] = self._get_exported_symbols()
results["pe_sections"] = self._get_sections()
results["pe_resources"] = self._get_resources()
results["pe_versioninfo"] = self._get_versioninfo()
results["pe_imphash"] = self._get_imphash()
results["pe_timestamp"] = self._get_timestamp()
results["pdb_path"] = self._get_pdb_path()
results["signature"] = self._get_signature()
results["imported_dll_count"] = len([x for x in results["pe_imports"] if x.get("dll")])
return results
If there is any documentation for this
Not sure about this point, cuckoo sandbox has detailed installation guide, how to modify and customization the modules and output, currently I am also unable to find documents.
If there is any confusion or you need more details you can ask,