diff --git a/capa/helpers.py b/capa/helpers.py index eaf64dd8..9c4c285e 100644 --- a/capa/helpers.py +++ b/capa/helpers.py @@ -14,7 +14,7 @@ from capa.features.common import FORMAT_SC32, FORMAT_SC64, FORMAT_UNKNOWN EXTENSIONS_SHELLCODE_32 = ("sc32", "raw32") EXTENSIONS_SHELLCODE_64 = ("sc64", "raw64") - +EXTENSIONS_ELF = "elf_" logger = logging.getLogger("capa") diff --git a/scripts/lint.py b/scripts/lint.py index db7e5dac..cc921e8a 100644 --- a/scripts/lint.py +++ b/scripts/lint.py @@ -312,9 +312,10 @@ def get_sample_capabilities(ctx: Context, path: Path) -> Set[str]: format_ = "sc64" else: format_ = "auto" - dnfile_extractor = capa.features.extractors.dnfile_.DnfileFeatureExtractor(nice_path) - if dnfile_extractor.is_dotnet_file(): - format_ = FORMAT_DOTNET + if not nice_path.endswith(capa.helpers.EXTENSIONS_ELF): + dnfile_extractor = capa.features.extractors.dnfile_.DnfileFeatureExtractor(nice_path) + if dnfile_extractor.is_dotnet_file(): + format_ = FORMAT_DOTNET logger.debug("analyzing sample: %s", nice_path) extractor = capa.main.get_extractor(nice_path, format_, "", DEFAULT_SIGNATURES, False, disable_progress=True)