diff options
| -rw-r--r-- | lualib/lua_magic/heuristics.lua | 18 | ||||
| -rw-r--r-- | lualib/lua_magic/patterns.lua | 3 |
2 files changed, 20 insertions, 1 deletions
diff --git a/lualib/lua_magic/heuristics.lua b/lualib/lua_magic/heuristics.lua index d9a7702a4..fb0a4b7c2 100644 --- a/lualib/lua_magic/heuristics.lua +++ b/lualib/lua_magic/heuristics.lua @@ -471,4 +471,22 @@ exports.pdf_format_heuristic = function(input, log_obj, pos, part) return 'pdf',weight end +exports.pe_part_heuristic = function(input, log_obj, pos, part) + if not input then + return + end + + local pe_ptr_bin = input:sub(60, 64) + if #pe_ptr_bin ~= 4 then + return + end + + local pe_ptr = rspamd_util.unpack("<H", pe_ptr_bin) + if pe_ptr ~= pos then + return + end + + return 'exe',15 +end + return exports diff --git a/lualib/lua_magic/patterns.lua b/lualib/lua_magic/patterns.lua index 5e62b47f9..8bdc7ea44 100644 --- a/lualib/lua_magic/patterns.lua +++ b/lualib/lua_magic/patterns.lua @@ -105,6 +105,7 @@ local patterns = { string = [[PE\x{00}\x{00}]], position = {'>=', 0x3c + 4}, weight = 15, + heuristic = heuristics.pe_part_heuristic, } } }, @@ -458,4 +459,4 @@ local patterns = { }, } -return patterns
\ No newline at end of file +return patterns |