\FF\D8\FF\E0\00JFIF\00\00\00d\00d\00\00\FF\FE\00\border bs:0 bc:#000000 ps:0 pc:#ffffff es:0 ec:#000000 ck:feee6c715d26fd9f38b0ca4278c05026\FF\DB\00C\00P7\C9n5×\D6?\BDê\9Ds\EBp\9F[`8m\B7)o\B5\E8\E6I\99\FE3]]A2\BA\8Cw\D6E\93\\DEv\C8\009\F2\F1NI?uc\\F5\EA\96k\xN<~buv\EA\C8\D7 \8B\84\CEcxI\BBg\AE\9E=\D6+n\EC\80\C8A\8C\AE\EB\CF\D5\DA\E9"2\A4\B9j5\EB\F3W\B63\96\B30Yu\DA\FC8\ED\DF\E7Ms\FB\F1\8E\B3\FA\EA\E8\E6(\883zs\F2_\8DFk\8Bh \00\8C\DCw\D3R\B5+6X\BA\B2\C4j\AB0\B4\FCMw\C2I\8E\9B\E3\A9~9u\FA\D3l\80\C8%p\EE\FDn2€ \00 $\FEj\C4e\A9\DB\~\95\A7\A5\80EK\BB\8DDsP\00@@AD'k\CF\E8\DB\D2(\80\9AK\D3\85\D6lb\F2\BA\8C*\80\00)\95 59\A3R:\F3\CE"\B6\80\88\00\00i1u4ê\E9\F2á\A6\A2\FACM\93WMb*\E0*\00\00\00\00\00(\A8\80\00\00\80\00\00\00\00\00\00\00\00\00\FF\D9 C/// """ This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program.  If not, see . Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see """ import base64 import binascii import csv import os from collections import namedtuple from contextlib import suppress from pathlib import Path from time import time from . import AIBOLIT ( SUSPICIOUS, VULNERS, EXTENDED_SUSPICIOUS, IGNORED_SUSPICIOUS, ) = ( "suspicious", "vulners", "extended-suspicious", "ignored-suspicious", ) SECTIONS = { "p": "php_malware", "j": "js_malware", "c": "cloudhash", "s": SUSPICIOUS, "v": VULNERS, "es": EXTENDED_SUSPICIOUS, "is": IGNORED_SUSPICIOUS, } SUSPICIOUS_SECTIONS = { SUSPICIOUS, VULNERS, EXTENDED_SUSPICIOUS, IGNORED_SUSPICIOUS, } AiBolitCSVReport = namedtuple( "AiBolitCSVReport", [ "section", "path", "signature", "ctime", "mtime", "size", "etime", "signature_id", "hash", "signature_name", "sha256", ], ) def parse_report_csv(report_path: Path): with report_path.open(newline="") as report_stream: for raw_row in csv.reader(report_stream, delimiter=","): row = AiBolitCSVReport(*raw_row) try: section = SECTIONS[row.section] except KeyError: continue sig = row.signature_name or "{}.{}".format( section, row.signature_id ) timestamp = ( int(float(row.etime)) if row.section != "v" else int(time()) ) file_name = row.path with suppress(binascii.Error): file_name = base64.b64decode(file_name, validate=True) file_name = os.fsdecode(file_name) yield { "n