From 3025acf1775d15c51e1cac248011b62072c2d46e Mon Sep 17 00:00:00 2001 From: GitHub Actions Date: Thu, 31 Oct 2024 11:39:40 +0000 Subject: [PATCH] style: Automatic code formatting --- modules/signatures/windows/antivm_recent_files.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/signatures/windows/antivm_recent_files.py b/modules/signatures/windows/antivm_recent_files.py index acb68127..e5744f71 100644 --- a/modules/signatures/windows/antivm_recent_files.py +++ b/modules/signatures/windows/antivm_recent_files.py @@ -1,5 +1,6 @@ from lib.cuckoo.common.abstracts import Signature + class DetectVirtualizationViaRecentFiles(Signature): name = "detect_virtualization_via_recent_files" description = "Detects virtualization via checking the last access time of recent files" @@ -23,7 +24,7 @@ def __init__(self, *args, **kwargs): def on_call(self, call, _): if call["api"] == "SHGetFolderPathW": folder = self.get_argument(call, "Folder") - if folder == '0x00000008': # CSIDL_RECENT + if folder == "0x00000008": # CSIDL_RECENT if self.pid: self.mark_call() self.recents = True @@ -38,4 +39,4 @@ def on_call(self, call, _): def on_complete(self): if self.recents and self.enumerate: return True - return False \ No newline at end of file + return False