codebase-scanner/signatures/1.mjs at master · mathiscode/codebase-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
/**
 * @typedef {Object} Signature
 * @property {string} name
 * @property {boolean} regex
 * @property {string} signature
 * @property {string[]} extensions
 * @property {string} level
*/

export default [
  {
    name: 'Obfuscated Python (PyArmor Runtime Import)',
    signature: 'from pytransform import pyarmor_runtime',
    extensions: ['py'],
    level: 'malicious'
  },
  {
    name: 'Obfuscated Python (PyArmor Runtime Call)',
    signature: 'pyarmor_runtime()',
    extensions: ['py'],
    level: 'malicious'
  },
  {
    name: 'Obfuscated Python (PyArmor Hook)',
    signature: '__pyarmor__(',
    extensions: ['py'],
    level: 'malicious'
  },
  {
    name: 'Python Eval Call',
    signature: 'eval(',
    extensions: ['py'],
    level: 'malicious'
  },
  {
    name: 'Python Exec Call',
    signature: 'exec(',
    extensions: ['py'],
    level: 'warning'
  },
  {
    name: 'Python Base64 Decode',
    signature: 'base64.b64decode(',
    extensions: ['py'],
    level: 'warning'
  },
  {
    name: 'Python Marshal Load',
    signature: 'marshal.loads(',
    extensions: ['py'],
    level: 'malicious'
  },
  {
    name: 'Pyminifier Artifact',
    signature: '# Created by pyminifier',
    extensions: ['py'],
    level: 'warning'
  }
]