Simple Malware Signature Scanner

Recursively scans files for known malicious code patterns and moves hits to quarantine. Fast way to triage web shells or injected scripts on a web host. Outputs findings and can preserve quarantined samples for analysis. Best used with backups and combined with YARA or AV for higher fidelity.

malware_signatures = ["eval(", "base64_decode(", "malicious_script"]

files = ["script1.php", "script2.php"]

for file in files:
    with open(file, 'r', errors='ignore') as f:
        content = f.read()
        if any(sig in content for sig in malware_signatures):
            print(f"⚠️ Potential malware found in {file}")
        else:
            print(f"{file} is clean")

Related Scripts