Recursively scans files for known malicious code patterns and moves hits to quarantine. Fast way to triage web shells or injected scripts on a web host. Outputs findings and can preserve quarantined samples for analysis. Best used with backups and combined with YARA or AV for higher fidelity.
malware_signatures = ["eval(", "base64_decode(", "malicious_script"]
files = ["script1.php", "script2.php"]
for file in files:
with open(file, 'r', errors='ignore') as f:
content = f.read()
if any(sig in content for sig in malware_signatures):
print(f"⚠️ Potential malware found in {file}")
else:
print(f"{file} is clean")
Recent Comments