From 36ce047ec0e1e41a2c2340381a0d62871027e4ed Mon Sep 17 00:00:00 2001 From: SolitudePy <47316655+SolitudePy@users.noreply.github.com> Date: Wed, 11 Jun 2025 22:01:49 +0300 Subject: [PATCH] PEBMASQ: return None instead of empty string --- volatility3/framework/plugins/windows/malware/pebmasquerade.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/malware/pebmasquerade.py b/volatility3/framework/plugins/windows/malware/pebmasquerade.py index be54300ff..72b138bae 100644 --- a/volatility3/framework/plugins/windows/malware/pebmasquerade.py +++ b/volatility3/framework/plugins/windows/malware/pebmasquerade.py @@ -49,7 +49,7 @@ class PebMasquerade(interfaces.plugins.PluginInterface): Union[str, PureWindowsPath]: The executable path as a string or PureWindowsPath. """ if not cmdline: - return "" + return None # Regex to extract first .exe ending string (handles quotes, paths, no quotes) match = re.search(r'(?i)(["\']?)([^"\']*?\.exe)\1(?=\s|$)', cmdline)