From 276ee748f2eafe708d11742990c3367d29db115e Mon Sep 17 00:00:00 2001 From: elhoim Date: Sun, 30 Aug 2026 23:47:45 +0000 Subject: [PATCH] Add filename|sha512 detection to looks_like_filename_hash looks_like_filename_hash checked md5/sha1/sha256 but never sha512, even though looks_like_sha512 already existed. As a result, values like 'malware.exe|<128 hex chars>' were never suggested as the valid MISP type filename|sha512. Add the missing sha512 branch. --- bin/cli.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bin/cli.py b/bin/cli.py index 92267b1..633b402 100644 --- a/bin/cli.py +++ b/bin/cli.py @@ -223,6 +223,8 @@ def looks_like_filename_hash(value: str) -> Tuple[bool, List[str]]: candidates.append("filename|sha1") if looks_like_sha256(right): candidates.append("filename|sha256") + if looks_like_sha512(right): + candidates.append("filename|sha512") return (len(candidates) > 0), candidates