blob: 9d66e307dba00fecbae25e506b7d4a68d4e44eb0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
|
import fnmatch
import glob
import os
import sys
try:
import yara
except ImportError:
print 'Please install python-yara'
sys.exit(0)
if len(sys.argv) != 2:
print 'Usage: %s folder_to_scan' % sys.argv[0]
rules = yara.compile('malwares.yara')
for root, dirnames, filenames in os.walk(sys.argv[1]):
for filename in fnmatch.filter(filenames, '*.ph*'):
fname = os.path.join(root, filename)
if os.stat(fname).st_size:
matches = rules.match(os.path.join(root, filename), fast=True)
if matches:
matches = matches.pop() # only one match, since we're scaning files
print str(matches) + fname
print '\n'.join(hex(m[0]) + ':' + m[1] + ': ' + m[2] for m in matches.strings)
|
