SMTP Entities MD5 Hash Defaults

Development
1

Hi all,

Currently, SMTP entities will calculate MD5 hashes for the following
filetypes by default: application/x-dosexec, application/x-executable. I
was a little surprised that common e-mail attack vectors like zip and PDF
files don't have this hash calculated by default. I propose extending the
default to also include application/zip and application/pdf. I think this
is good default functionality, that won't cause a noticeable performance
hit.

Thoughts? Any other filetypes that would be useful to add there, while
we're at it?

  --Vlad

2


Would you be up for just writing a script that does it for now? Maybe also a script that checks SMTP hashes with the malware hash registry like we're doing for HTTP?

I'm not crazy about doing much work on the pre-2.2 because once the file analysis framework is integrated everything will be different and much better anyway.

  .Seth