h d Z ddlZddlZddlZddlZddlmZ ddlmZ ddl m
Z
ddl m Z ddl m
Z
d \ ZZZZd
d d eeeed
ZeeeehZ edg d Zde
fdZddZdS )u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N)
namedtuple)suppress)Path)time )AIBOLIT)
suspiciousvulnerszextended-suspiciouszignored-suspicious php_malware
js_malware cloudhash)pjcsvesisAiBolitCSVReport) sectionpath signaturectimemtimesizeetime signature_idhashsignature_namesha256 report_pathc
# d K | d 5 }t j |d D ]e}t | } t |j }n# t $ r Y ,w xY w|j pd ||j }|j dk r!t t |j nt t }|j }t t j 5 t% j |d }d d d n # 1 swxY w Y t) j | }t, ||t |j t |j |t2 v t |j pd |j p|j pd ||t: k d
V g d d d d S # 1 swxY w Y d S ) N )newline,) delimiterz{}.{}r Tvalidater )
name file_namer r modification_timer r r timestampextended_suspicious) opencsvreaderr SECTIONSr KeyErrorr formatr intfloatr r r r binasciiErrorbase64 b64decodeosfsdecoder r r SUSPICIOUS_SECTIONSr r r EXTENDED_SUSPICIOUS)r!
report_streamraw_rowrowr sigr, r* s Y/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/scan/ai_bolit/report.pyparse_report_csvrC O sQ " % % z-3??? G"G,C
"3;/
$ )) )C *-););E#)$$%%%TVV
I(.))
G
G " ,Y F F F
G
G
G
G
G
G
G
G
G
G
G
G
G
G
G I..I & SY %(^^ %)< <CHM**
6ch6$ &'.2E'E
! sZ #F%AF%
A F% A B F%)D F% D F%D BF%%F),F)Tc # K t D ]b}| |g D ]G}| d p)d |t |d g }|dk r"t t
|d nt t }|d }|rGt t j
5 t j |d }d d d n # 1 swxY w Y t j | }t |||t v |d |d
|d | d | d
||t" k d
V Idd S )Nsn.sigidr
etfnTr' szctmtr r )
r) r* r r r r r+ r r, r- )r1 valuesgetjoinstrr4 r5 r r r6 r7 r8 r9 r: r; r r< r= )report base64_pathr hitrA r, r* s rB parse_report_jsonrT o s ??$$ ::gr** C''$--I388Wc#g,6G6G,H#I#IC
*1I)=)=E#d)$$%%%3tvv;;
D I
K hn-- K K & 0T J J JIK K K K K K K K K K K K K K K I..I & %)< <D T%(Y#''&//:: &'.2E'E
s D D D )T)__doc__r8 r6 r/ r: collectionsr
contextlibr pathlibr r r# r
SUSPICIOUSVULNERSr= IGNORED_SUSPICIOUSr1 r< r rC rT rB r^ s> *
" " " " " "
: $ $ @ r]