Skip to content

Commit

Permalink
style: Automatic code formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
actions-user committed Oct 5, 2024
1 parent 5a6c536 commit c9ccb42
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 3 deletions.
5 changes: 3 additions & 2 deletions modules/signatures/all/packer_entropy.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@

from lib.cuckoo.common.abstracts import Signature


class PackerEntropy(Signature):
name = "packer_entropy"
description = "The binary likely contains encrypted or compressed data"
Expand All @@ -30,7 +31,7 @@ class PackerEntropy(Signature):
"http://www.forensickb.com/2013/03/file-entropy-explained.html",
"http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf",
]

def run(self):
ret = False

Expand All @@ -47,7 +48,7 @@ def run(self):
if float(section["entropy"]) > 6.8:
self.data.append({"section": section})
total_compressed += int(section["size_of_data"], 16)

if total_pe_data and ((1.0 * total_compressed) / total_pe_data) > 0.2:
ret = True

Expand Down
3 changes: 2 additions & 1 deletion modules/signatures/all/packer_yoda.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@

from lib.cuckoo.common.abstracts import Signature


class YodaPacked(Signature):
name = "packer_yoda"
description = "Executable file is packed/obfuscated with Y0da"
Expand All @@ -37,6 +38,6 @@ def run(self):
for section in pe["sections"]:
if section["name"].startswith(".yP") or section["name"].startswith(".y0da"):
self.data.append({"section": section})
ret = True
ret = True

return ret

0 comments on commit c9ccb42

Please sign in to comment.