Some PE's are classified as js

CERT-Polska · Jul 22, 2021 · 16969e2 · 16969e2
1 parent a02d9e6
commit 16969e2
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/sflock/ident.py b/sflock/ident.py
@@ -251,6 +251,9 @@ def powershell(f):
 
 
 def javascript(f):
+    if f.contents[:2] == b'MZ':
+        return None
+
     JS_STRS = [
         b"var ",
         b"function ",