Skip to content

Commit

Permalink
style: Automatic code formatting
Browse files Browse the repository at this point in the history
  • Loading branch information
actions-user committed Oct 31, 2024
1 parent 230495d commit 3025acf
Showing 1 changed file with 3 additions and 2 deletions.
5 changes: 3 additions & 2 deletions modules/signatures/windows/antivm_recent_files.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
from lib.cuckoo.common.abstracts import Signature


class DetectVirtualizationViaRecentFiles(Signature):
name = "detect_virtualization_via_recent_files"
description = "Detects virtualization via checking the last access time of recent files"
Expand All @@ -23,7 +24,7 @@ def __init__(self, *args, **kwargs):
def on_call(self, call, _):
if call["api"] == "SHGetFolderPathW":
folder = self.get_argument(call, "Folder")
if folder == '0x00000008': # CSIDL_RECENT
if folder == "0x00000008": # CSIDL_RECENT
if self.pid:
self.mark_call()
self.recents = True
Expand All @@ -38,4 +39,4 @@ def on_call(self, call, _):
def on_complete(self):
if self.recents and self.enumerate:
return True
return False
return False

0 comments on commit 3025acf

Please sign in to comment.