diff options
| author | Julien (jvoisin) Voisin | 2016-02-24 18:09:10 +0100 |
|---|---|---|
| committer | Julien (jvoisin) Voisin | 2016-02-24 18:09:10 +0100 |
| commit | ae5f8ca1f9e024352351444e2c9c232cf28120c2 (patch) | |
| tree | 7c002a079b80f4c19b2b5fd8fb75fc53c8fd63c9 | |
| parent | 348acbb3f7947f2527b2e5491bbaf9424fc41c96 (diff) | |
Remove a useless file
| -rw-r--r-- | php-malware-finder/poc.py | 30 |
1 files changed, 0 insertions, 30 deletions
diff --git a/php-malware-finder/poc.py b/php-malware-finder/poc.py deleted file mode 100644 index be8e612..0000000 --- a/php-malware-finder/poc.py +++ /dev/null | |||
| @@ -1,30 +0,0 @@ | |||
| 1 | #!/usr/bin/env python | ||
| 2 | |||
| 3 | import fnmatch | ||
| 4 | import os | ||
| 5 | import sys | ||
| 6 | import time | ||
| 7 | |||
| 8 | try: | ||
| 9 | import yara | ||
| 10 | except ImportError: | ||
| 11 | print 'Please install python-yara' | ||
| 12 | sys.exit(0) | ||
| 13 | |||
| 14 | if len(sys.argv) != 2: | ||
| 15 | print 'Usage: %s folder_to_scan' % sys.argv[0] | ||
| 16 | |||
| 17 | rules = yara.compile('malwares.yara') | ||
| 18 | |||
| 19 | for cpt, (root, dirnames, filenames) in enumerate(os.walk(sys.argv[1])): | ||
| 20 | for filename in fnmatch.filter(filenames, '*.ph*'): | ||
| 21 | if not cpt % 1000: | ||
| 22 | time.sleep(3) | ||
| 23 | fname = os.path.join(root, filename) | ||
| 24 | if os.stat(fname).st_size: | ||
| 25 | matches = rules.match(os.path.join(root, filename), fast=True) | ||
| 26 | if matches: | ||
| 27 | matches = matches.pop() # only one match, since we're scaning files | ||
| 28 | print str(matches) + fname | ||
| 29 | print '\n'.join(hex(m[0]) + ':' + m[1] + ': ' + m[2] for m in matches.strings) | ||
| 30 | |||
