collect file extensions seen in CAPE sample imports

[williballenthin]

capa/capa/features/extractors/helpers.py

Lines 57 to 59 in b8b55f4

	# trim extensions observed in dynamic traces
	dll = dll[0:-4] if dll.endswith(".dll") else dll
	dll = dll[0:-4] if dll.endswith(".drv") else dll

[williballenthin]

❯ jq ".static.pe.imports[].dll" mnt/public_full_reports/0* | tr "[:upper:]" "[:lower:]" | sed -e "s/^.*\(\.[^.]*\)\"/\1/g" | sort | uniq -c | sort -nr
  18651 .dll
    404 .drv
      4 .ocx
      2 "*invalid*"
      1 "ntdll"

[mr-tz]

I propose to remove this in an upcoming PR to address #1815.

[mr-tz]

Although, should we keep the DLL name for imports? We'll always have these.

[mr-tz]

Are we fine leaving it with .dll and .drv?

[williballenthin]

[williballenthin]

[mr-tz]

can this be closed?