From 85373a7ddb89b6ab5f973f774b7c6ec8e909e5b4 Mon Sep 17 00:00:00 2001
From: Mike Hunhoff <mike.hunhoff@gmail.com>
Date: Wed, 24 Jul 2024 10:09:22 -0600
Subject: [PATCH] cape: add explicit check for CAPE report format file
 extension

---
 capa/helpers.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/capa/helpers.py b/capa/helpers.py
index 3a8fee5e..9de2cbd9 100644
--- a/capa/helpers.py
+++ b/capa/helpers.py
@@ -132,7 +132,7 @@ def get_format_from_report(sample: Path) -> str:
             if "logs/summary_v2.json" in namelist and "logs/flog.xml" in namelist:
                 # assume VMRay zipfile at a minimum has these files
                 return FORMAT_VMRAY
-    else:
+    elif sample.name.endswith(("json", "json_", "json.gz")):
         report = load_json_from_path(sample)
         if "CAPE" in report:
             return FORMAT_CAPE
@@ -140,6 +140,7 @@ def get_format_from_report(sample: Path) -> str:
             # CAPE report that's missing the "CAPE" key,
             # which is not going to be much use, but its correct.
             return FORMAT_CAPE
+            
     return FORMAT_UNKNOWN