Merge pull request hatching#12 from AvihayST/fix/ident-packages

Golang files get ps1 and vbs package due to some string's inside
CERT-Polska · Jul 25, 2021 · f4a06a7 · f4a06a7
2 parents ae1216c + fff63a6
commit f4a06a7
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/sflock/ident.py b/sflock/ident.py
@@ -229,6 +229,9 @@ def office_ole(f):
 
 
 def powershell(f):
+    if f.contents[:2] == b'MZ':
+        return None
+
     POWERSHELL_STRS = [
         b"$PSHOME",
         b"Get-WmiObject",
@@ -299,6 +302,9 @@ def pub(f):
 
 
 def visualbasic(f):
+    if f.contents[:2] == b'MZ':
+        return None
+
     VB_STRS = [
         b"Dim ",
         b"dim ",