diff --git a/modules/signatures/windows/antivm_recent_files.py b/modules/signatures/windows/antivm_recent_files.py index acb68127..e5744f71 100644 --- a/modules/signatures/windows/antivm_recent_files.py +++ b/modules/signatures/windows/antivm_recent_files.py @@ -1,5 +1,6 @@ from lib.cuckoo.common.abstracts import Signature + class DetectVirtualizationViaRecentFiles(Signature): name = "detect_virtualization_via_recent_files" description = "Detects virtualization via checking the last access time of recent files" @@ -23,7 +24,7 @@ def __init__(self, *args, **kwargs): def on_call(self, call, _): if call["api"] == "SHGetFolderPathW": folder = self.get_argument(call, "Folder") - if folder == '0x00000008': # CSIDL_RECENT + if folder == "0x00000008": # CSIDL_RECENT if self.pid: self.mark_call() self.recents = True @@ -38,4 +39,4 @@ def on_call(self, call, _): def on_complete(self): if self.recents and self.enumerate: return True - return False \ No newline at end of file + return False