diff options
| author | Andrew Lewis <nerf@judo.za.org> | 2021-01-04 13:41:04 +0200 |
|---|---|---|
| committer | Andrew Lewis <nerf@judo.za.org> | 2021-01-04 13:41:04 +0200 |
| commit | 7679fd1222d6e7b6bbead83aa0ea7c2a5effdc21 (patch) | |
| tree | 2fe1d93a49bd0b12b347934dff05cf2799e8f2f3 | |
| parent | a40cab36960c258f45ff3ee6053a8af78e9c493d (diff) | |
| download | rspamd-7679fd1222d6e7b6bbead83aa0ea7c2a5effdc21.tar.gz rspamd-7679fd1222d6e7b6bbead83aa0ea7c2a5effdc21.zip | |
[Minor] Magic: try avoid false positive exe detection
| -rw-r--r-- | lualib/lua_magic/heuristics.lua | 18 | ||||
| -rw-r--r-- | lualib/lua_magic/patterns.lua | 3 |
2 files changed, 20 insertions, 1 deletions
diff --git a/lualib/lua_magic/heuristics.lua b/lualib/lua_magic/heuristics.lua index d9a7702a4..fb0a4b7c2 100644 --- a/lualib/lua_magic/heuristics.lua +++ b/lualib/lua_magic/heuristics.lua @@ -471,4 +471,22 @@ exports.pdf_format_heuristic = function(input, log_obj, pos, part) return 'pdf',weight end +exports.pe_part_heuristic = function(input, log_obj, pos, part) + if not input then + return + end + + local pe_ptr_bin = input:sub(60, 64) + if #pe_ptr_bin ~= 4 then + return + end + + local pe_ptr = rspamd_util.unpack("<H", pe_ptr_bin) + if pe_ptr ~= pos then + return + end + + return 'exe',15 +end + return exports diff --git a/lualib/lua_magic/patterns.lua b/lualib/lua_magic/patterns.lua index 5e62b47f9..8bdc7ea44 100644 --- a/lualib/lua_magic/patterns.lua +++ b/lualib/lua_magic/patterns.lua @@ -105,6 +105,7 @@ local patterns = { string = [[PE\x{00}\x{00}]], position = {'>=', 0x3c + 4}, weight = 15, + heuristic = heuristics.pe_part_heuristic, } } }, @@ -458,4 +459,4 @@ local patterns = { }, } -return patterns
\ No newline at end of file +return patterns |