PHP Malware Finder

Overview

Build Status

PHP Malware Finder

 _______  __   __  _______
|  ___  ||  |_|  ||       |
| |   | ||       ||    ___|
| |___| ||       ||   |___   Webshell finder,
|    ___||       ||    ___|   kiddies hunter,
|   |    | ||_|| ||   |		website cleaner.
|___|    |_|   |_||___|

Detect potentially malicious PHP files.

What does it detect?

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

The following list of encoders/obfuscators/webshells are also detected:

Of course it's trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement.

How does it work?

Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple!

Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like "a $_GET variable is decoded two times, unzipped, and then passed to some dangerous function like system".

Installation

  • Install Yara.
    This is also possible via some Linux package managers:
    • Debian: sudo apt-get install yara
    • Red Hat: yum install yara (requires the EPEL repository)

You can also compile it from source:

git clone [email protected]:VirusTotal/yara.git
cd yara/
YACC=bison ./configure
make
  • Download php-malware-finder git clone https://github.com/jvoisin/php-malware-finder.git

How to use it?

$ ./phpmalwarefinder -h
Usage phpmalwarefinder [-cfhtvl] <file|folder> ...
    -c  Optional path to a rule file
    -f  Fast mode
    -h  Show this help message
    -t  Specify the number of threads to use (8 by default)
    -v  Verbose mode

Or if you prefer to use yara:

$ yara -r ./php.yar /var/www

Please keep in mind that you should use at least YARA 3.4 because we're using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes.

Oh, and by the way, you can run the comprehensive testsuite with make tests.

Whitelisting

Check the whitelist.yar file. If you're lazy, you can generate whitelists for entire folders with the generate_whitelist.py script.

Why should I use it instead of something else?

Because:

  • It doesn't use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells
  • It has a complete testsuite, to avoid regressions
  • Its whitelist system doesn't rely on filenames
  • It doesn't rely on (slow) entropy computation
  • It uses a ghetto-style static analysis, instead of relying on file hashes
  • Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files

Licensing

PHP-malware-finder is licensed under the GNU Lesser General Public License v3.

The amazing YARA project is licensed under the Apache v2.0 license.

Patches, whitelists or samples are of course more than welcome.

Comments
  • Write a better rule?

    Write a better rule?

    Given how many .htaccess based web shell blog posts and clones there is of my project I seriously don't think my handle is a great rule. You could match on the .htaccess syntax instead and catch others. If not I guess I'll just alter my repo and invalidate your rule

    invalid 
    opened by EMSeek 15
  • No malware detected

    No malware detected

    Hi Devs and thanks for your wonderful work!

    Recently I've discovered some malicious php script, inside my Joomla installation. I've found this malicious code, inside a map component, using Website Antivirus Scanner for Joomla, so I've installed php-malware-finder and thest again the php code, but with no evidence of that specific malicious code.

    Are you interested to deeper the situation?

    Many thanks!

    davide

    invalid 
    opened by danjde 6
  • Not an issue but a thank you!

    Not an issue but a thank you!

    Hello,

    The software is pretty good and it helped me to get rid of malware in one of my websites. It works as advertised and it is very easy to use!

    I wrote a small article on Medium so more people get their hand in this tool.

    (By the way, feel free to delete this post after you read it. I don't want to use your site to advertise my article but I could not find an email or other way to reach out to the team).

    Thanks!

    opened by josevnz 3
  • warning: $pr contains .* or .+

    warning: $pr contains .* or .+

    When executing the command: $ ./phpmalwarefinder /var/www, this message appears: ./php.yar(95): warning: $pr contains .* or .+, consider using .{,N} or .{1,N} with a reasonable value for N

    yara --version: 3.9.0

    I searched for the error, but found no solution or tips.

    opened by pawatecnologia 3
  • fatal pointer error on `--long-lines` due to outdated dependency

    fatal pointer error on `--long-lines` due to outdated dependency

    The currently-used version of go-yara (V4.2.1) panics when ran with especially long lines. I came across this issue while testing the project in a docker container.

    issue: https://github.com/hillu/go-yara/issues/101

    docker run -it --tty --rm -v "$PWD":/data phpmalwarefinder # with -L in Dockerfile

    runtime: bad pointer in frame github.com/hillu/go-yara/v4.(*Scanner).putCallbackData.func1 at 0xc0007ddd00: 0xa3d
    fatal error: invalid pointer found on stack
    
    runtime stack:
    runtime.throw({0x6b7bf4?, 0x8ce8a0?})
    	/usr/local/go/src/runtime/panic.go:992 +0x71 fp=0x7f7a4d16e258 sp=0x7f7a4d16e228 pc=0x437e71
    runtime.adjustpointers(0x7f7a4d16e648?, 0x8e67c?, 0x847bde?, {0x8b2f60?, 0x8ce8a0?})
    	/usr/local/go/src/runtime/stack.go:628 +0x1d0 fp=0x7f7a4d16e2c0 sp=0x7f7a4d16e258 pc=0x44f8f0
    runtime.adjustframe(0x7f7a4d16e648, 0x7f7a4d16e738)
    	/usr/local/go/src/runtime/stack.go:670 +0xc9 fp=0x7f7a4d16e350 sp=0x7f7a4d16e2c0 pc=0x44fa09
    runtime.gentraceback(0x0?, 0x7f7a4d16e6a0?, 0x18?, 0x7f7a4d16e0b0?, 0x0, 0x0, 0x7fffffff, 0x72ee50, 0x297888d7?, 0x0)
    	/usr/local/go/src/runtime/traceback.go:330 +0xb2f fp=0x7f7a4d16e6b0 sp=0x7f7a4d16e350 pc=0x45a0cf
    runtime.copystack(0xc0002fdd40, 0x7f7a4d16e0b0?)
    	/usr/local/go/src/runtime/stack.go:930 +0x2f5 fp=0x7f7a4d16e868 sp=0x7f7a4d16e6b0 pc=0x450215
    runtime.shrinkstack(0xc0002fdd40)
    	/usr/local/go/src/runtime/stack.go:1212 +0x126 fp=0x7f7a4d16e888 sp=0x7f7a4d16e868 pc=0x4510e6
    runtime.newstack()
    	/usr/local/go/src/runtime/stack.go:1060 +0x3aa fp=0x7f7a4d16ea40 sp=0x7f7a4d16e888 pc=0x4506aa
    runtime.morestack()
    	/usr/local/go/src/runtime/asm_amd64.s:547 +0x8b fp=0x7f7a4d16ea48 sp=0x7f7a4d16ea40 pc=0x4646cb
    
    goroutine 25 [running]:
    runtime.cgoCheckPointer({0x6616a0, 0xa3d}, {0x0, 0x0})
    	/usr/local/go/src/runtime/cgocall.go:392 +0x196 fp=0xc0007ddcd8 sp=0xc0007ddcd0 pc=0x408456
    github.com/hillu/go-yara/v4.(*Scanner).putCallbackData.func1(0x676840?, 0xc000264900?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:127 +0x5a fp=0xc0007ddd20 sp=0xc0007ddcd8 pc=0x62b0ba
    github.com/hillu/go-yara/v4.(*Scanner).putCallbackData(0xc000092240)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:127 +0x138 fp=0xc0007ddd80 sp=0xc0007ddd20 pc=0x62b038
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092240, {0xc000306a10?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:161 +0x5c fp=0xc0007ddde0 sp=0xc0007ddd80 pc=0x62b17c
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0007ddfb0 sp=0xc0007ddde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0007ddfe0 sp=0xc0007ddfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0007ddfe8 sp=0xc0007ddfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 1 [chan receive]:
    runtime.gopark(0xc0002cef00?, 0x93?, 0x87?, 0x50?, 0xc09c532ef57b2abd?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000113788 sp=0xc000113768 pc=0x43a956
    runtime.chanrecv(0xc0000161e0, 0xc000113978, 0x1)
    	/usr/local/go/src/runtime/chan.go:577 +0x56c fp=0xc000113818 sp=0xc000113788 pc=0x40ad2c
    runtime.chanrecv2(0xc000113b00?, 0xc0001139f8?)
    	/usr/local/go/src/runtime/chan.go:445 +0x18 fp=0xc000113840 sp=0xc000113818 pc=0x40a798
    main.main()
    	/app/main.go:407 +0xe1e fp=0xc000113f80 sp=0xc000113840 pc=0x6411de
    runtime.main()
    	/usr/local/go/src/runtime/proc.go:250 +0x212 fp=0xc000113fe0 sp=0xc000113f80 pc=0x43a592
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000113fe8 sp=0xc000113fe0 pc=0x4667a1
    
    goroutine 2 [force gc (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00003cfb0 sp=0xc00003cf90 pc=0x43a956
    runtime.goparkunlock(...)
    	/usr/local/go/src/runtime/proc.go:367
    runtime.forcegchelper()
    	/usr/local/go/src/runtime/proc.go:301 +0xad fp=0xc00003cfe0 sp=0xc00003cfb0 pc=0x43a7ed
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00003cfe8 sp=0xc00003cfe0 pc=0x4667a1
    created by runtime.init.6
    	/usr/local/go/src/runtime/proc.go:289 +0x25
    
    goroutine 3 [GC sweep wait]:
    runtime.gopark(0x8f7901?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00003d790 sp=0xc00003d770 pc=0x43a956
    runtime.goparkunlock(...)
    	/usr/local/go/src/runtime/proc.go:367
    runtime.bgsweep(0x0?)
    	/usr/local/go/src/runtime/mgcsweep.go:297 +0xd7 fp=0xc00003d7c8 sp=0xc00003d790 pc=0x427ab7
    runtime.gcenable.func1()
    	/usr/local/go/src/runtime/mgc.go:177 +0x26 fp=0xc00003d7e0 sp=0xc00003d7c8 pc=0x41d666
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00003d7e8 sp=0xc00003d7e0 pc=0x4667a1
    created by runtime.gcenable
    	/usr/local/go/src/runtime/mgc.go:177 +0x6b
    
    goroutine 4 [GC scavenge wait]:
    runtime.gopark(0x8f7940?, 0x10000?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00003df20 sp=0xc00003df00 pc=0x43a956
    runtime.goparkunlock(...)
    	/usr/local/go/src/runtime/proc.go:367
    runtime.bgscavenge(0x0?)
    	/usr/local/go/src/runtime/mgcscavenge.go:364 +0x2a5 fp=0xc00003dfc8 sp=0xc00003df20 pc=0x4258c5
    runtime.gcenable.func2()
    	/usr/local/go/src/runtime/mgc.go:178 +0x26 fp=0xc00003dfe0 sp=0xc00003dfc8 pc=0x41d606
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00003dfe8 sp=0xc00003dfe0 pc=0x4667a1
    created by runtime.gcenable
    	/usr/local/go/src/runtime/mgc.go:178 +0xaa
    
    goroutine 5 [finalizer wait]:
    runtime.gopark(0x0?, 0x72eba0?, 0x0?, 0x60?, 0x1000000010?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00003c630 sp=0xc00003c610 pc=0x43a956
    runtime.goparkunlock(...)
    	/usr/local/go/src/runtime/proc.go:367
    runtime.runfinq()
    	/usr/local/go/src/runtime/mfinal.go:177 +0xb3 fp=0xc00003c7e0 sp=0xc00003c630 pc=0x41c713
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00003c7e8 sp=0xc00003c7e0 pc=0x4667a1
    created by runtime.createfing
    	/usr/local/go/src/runtime/mfinal.go:157 +0x45
    
    goroutine 6 [syscall]:
    runtime.cgocall(0x642c10, 0xc0000a5d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0000a5d18 sp=0xc0000a5ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c826550, 0x7f7a4adee000)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0000a5d40 sp=0xc0000a5d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000780000?, 0x55?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0000a5d80 sp=0xc0000a5d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000780000, {0xc000147380?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0000a5de0 sp=0xc0000a5d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0000a5fb0 sp=0xc0000a5de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0000a5fe0 sp=0xc0000a5fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0000a5fe8 sp=0xc0000a5fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 7 [syscall]:
    runtime.cgocall(0x642c10, 0xc000197d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000197d18 sp=0xc000197ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825800, 0x7f7a4a245f20)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000197d40 sp=0xc000197d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000402060?, 0x5e?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000197d80 sp=0xc000197d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000402060, {0xc0006f8660?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000197de0 sp=0xc000197d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000197fb0 sp=0xc000197de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000197fe0 sp=0xc000197fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000197fe8 sp=0xc000197fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 8 [syscall]:
    runtime.cgocall(0x642c10, 0xc0005edd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0005edd18 sp=0xc0005edce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825980, 0x7f7a4adee060)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0005edd40 sp=0xc0005edd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0000921b0?, 0x52?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0005edd80 sp=0xc0005edd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0000921b0, {0xc00015a600?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0005edde0 sp=0xc0005edd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0005edfb0 sp=0xc0005edde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0005edfe0 sp=0xc0005edfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0005edfe8 sp=0xc0005edfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 9 [syscall]:
    runtime.cgocall(0x642c10, 0xc0004f5d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0004f5d18 sp=0xc0004f5ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825740, 0x7f7a499f3d70)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0004f5d40 sp=0xc0004f5d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc00048e000?, 0x76?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0004f5d80 sp=0xc0004f5d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc00048e000, {0xc000290680?, 0xc000290680?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0004f5de0 sp=0xc0004f5d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0004f5fb0 sp=0xc0004f5de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0004f5fe0 sp=0xc0004f5fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0004f5fe8 sp=0xc0004f5fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 10 [syscall]:
    runtime.cgocall(0x642c10, 0xc0002add40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0002add18 sp=0xc0002adce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4ce35d00, 0x7f7a4a0eb2e0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0002add40 sp=0xc0002add18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092180?, 0x63?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0002add80 sp=0xc0002add40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092180, {0xc0003c8380?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0002adde0 sp=0xc0002add80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0002adfb0 sp=0xc0002adde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0002adfe0 sp=0xc0002adfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0002adfe8 sp=0xc0002adfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 11 [syscall]:
    runtime.cgocall(0x642c10, 0xc0006b1d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0006b1d18 sp=0xc0006b1ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825680, 0x7f7a4a61f840)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0006b1d40 sp=0xc0006b1d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000402030?, 0x6b?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0006b1d80 sp=0xc0006b1d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000402030, {0xc000242070?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0006b1de0 sp=0xc0006b1d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0006b1fb0 sp=0xc0006b1de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0006b1fe0 sp=0xc0006b1fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0006b1fe8 sp=0xc0006b1fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 12 [syscall]:
    runtime.cgocall(0x642c10, 0xc0004b3d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0004b3d18 sp=0xc0004b3ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4ce35c10, 0x7f7a74219390)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0004b3d40 sp=0xc0004b3d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000398000?, 0x4d?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0004b3d80 sp=0xc0004b3d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000398000, {0xc0004fcd20?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0004b3de0 sp=0xc0004b3d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0004b3fb0 sp=0xc0004b3de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0004b3fe0 sp=0xc0004b3fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0004b3fe8 sp=0xc0004b3fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 13 [syscall]:
    runtime.cgocall(0x642c10, 0xc00062bd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00062bd18 sp=0xc00062bce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a74119ce0, 0x7f7a4a245f90)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00062bd40 sp=0xc00062bd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000402000?, 0x6a?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00062bd80 sp=0xc00062bd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000402000, {0xc0003062a0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00062bde0 sp=0xc00062bd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00062bfb0 sp=0xc00062bde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00062bfe0 sp=0xc00062bfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00062bfe8 sp=0xc00062bfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 14 [syscall]:
    runtime.cgocall(0x642c10, 0xc000695d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000695d18 sp=0xc000695ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a74119c00, 0x7f7a499f3af0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000695d40 sp=0xc000695d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092030?, 0x7b?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000695d80 sp=0xc000695d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092030, {0xc00020e200?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000695de0 sp=0xc000695d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000695fb0 sp=0xc000695de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000695fe0 sp=0xc000695fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000695fe8 sp=0xc000695fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 15 [syscall]:
    runtime.cgocall(0x642c10, 0xc0003add40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0003add18 sp=0xc0003adce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x92fc00, 0x7f7a742193f0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0003add40 sp=0xc0003add18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092060?, 0x5a?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0003add80 sp=0xc0003add40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092060, {0xc0002124e0?, 0xc0002124e0?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0003adde0 sp=0xc0003add80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0003adfb0 sp=0xc0003adde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0003adfe0 sp=0xc0003adfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0003adfe8 sp=0xc0003adfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 16 [syscall]:
    runtime.cgocall(0x642c10, 0xc00022bd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00022bd18 sp=0xc00022bce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x92fd10, 0x7f7a4a4785c0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00022bd40 sp=0xc00022bd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092090?, 0x4a?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00022bd80 sp=0xc00022bd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092090, {0xc000830140?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00022bde0 sp=0xc00022bd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00022bfb0 sp=0xc00022bde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00022bfe0 sp=0xc00022bfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00022bfe8 sp=0xc00022bfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 18 [syscall]:
    runtime.cgocall(0x642c10, 0xc00033dd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00033dd18 sp=0xc00033dce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x92f810, 0x7f7a499f3b70)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00033dd40 sp=0xc00033dd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0000920c0?, 0x6d?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00033dd80 sp=0xc00033dd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0000920c0, {0xc000178070?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00033dde0 sp=0xc00033dd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00033dfb0 sp=0xc00033dde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00033dfe0 sp=0xc00033dfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00033dfe8 sp=0xc00033dfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 19 [syscall]:
    runtime.cgocall(0x642c10, 0xc0009b7d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0009b7d18 sp=0xc0009b7ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x92f900, 0x7f7a49cfcab0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0009b7d40 sp=0xc0009b7d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0000920f0?, 0x65?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0009b7d80 sp=0xc0009b7d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0000920f0, {0xc000242380?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0009b7de0 sp=0xc0009b7d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0009b7fb0 sp=0xc0009b7de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0009b7fe0 sp=0xc0009b7fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0009b7fe8 sp=0xc0009b7fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 20 [syscall]:
    runtime.cgocall(0x642c10, 0xc0001b7d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0001b7d18 sp=0xc0001b7ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4ce35a20, 0x7f7a74219330)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0001b7d40 sp=0xc0001b7d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092120?, 0x58?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0001b7d80 sp=0xc0001b7d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092120, {0xc0006f83c0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0001b7de0 sp=0xc0001b7d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0001b7fb0 sp=0xc0001b7de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0001b7fe0 sp=0xc0001b7fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0001b7fe8 sp=0xc0001b7fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 21 [syscall]:
    runtime.cgocall(0x642c10, 0xc00041fd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00041fd18 sp=0xc00041fce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4ce35b10, 0x7f7a4adee0c0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00041fd40 sp=0xc00041fd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092150?, 0x4c?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00041fd80 sp=0xc00041fd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092150, {0xc000974370?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00041fde0 sp=0xc00041fd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00041ffb0 sp=0xc00041fde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00041ffe0 sp=0xc00041ffb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00041ffe8 sp=0xc00041ffe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 22 [syscall]:
    runtime.cgocall(0x642c10, 0xc0006e5d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0006e5d18 sp=0xc0006e5ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a74219ed0, 0x7f7a4a478570)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0006e5d40 sp=0xc0006e5d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092000?, 0x46?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0006e5d80 sp=0xc0006e5d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092000, {0xc0008300a0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0006e5de0 sp=0xc0006e5d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0006e5fb0 sp=0xc0006e5de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0006e5fe0 sp=0xc0006e5fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0006e5fe8 sp=0xc0006e5fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 23 [syscall]:
    runtime.cgocall(0x642c10, 0xc0005c5d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0005c5d18 sp=0xc0005c5ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825d70, 0x7f7a49cfca40)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0005c5d40 sp=0xc0005c5d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000680000?, 0x65?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0005c5d80 sp=0xc0005c5d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000680000, {0xc0002422a0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0005c5de0 sp=0xc0005c5d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0005c5fb0 sp=0xc0005c5de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0005c5fe0 sp=0xc0005c5fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0005c5fe8 sp=0xc0005c5fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 24 [syscall]:
    runtime.cgocall(0x642c10, 0xc00064fd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00064fd18 sp=0xc00064fce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c8260a0, 0x7f7a742192d0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00064fd40 sp=0xc00064fd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0004020c0?, 0x53?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00064fd80 sp=0xc00064fd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0004020c0, {0xc0006f8240?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00064fde0 sp=0xc00064fd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00064ffb0 sp=0xc00064fde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00064ffe0 sp=0xc00064ffb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00064ffe8 sp=0xc00064ffe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 26 [syscall]:
    runtime.cgocall(0x642c10, 0xc00044dd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00044dd18 sp=0xc00044dce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825a70, 0x7f7a49994b70)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00044dd40 sp=0xc00044dd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc00048e030?, 0x7d?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00044dd80 sp=0xc00044dd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc00048e030, {0xc000576780?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00044dde0 sp=0xc00044dd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00044dfb0 sp=0xc00044dde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00044dfe0 sp=0xc00044dfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00044dfe8 sp=0xc00044dfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 27 [syscall]:
    runtime.cgocall(0x642c10, 0xc0000fbd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0000fbd18 sp=0xc0000fbce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825fe0, 0x7f7a499f3c70)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0000fbd40 sp=0xc0000fbd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000510030?, 0x72?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0000fbd80 sp=0xc0000fbd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000510030, {0xc000290080?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0000fbde0 sp=0xc0000fbd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0000fbfb0 sp=0xc0000fbde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0000fbfe0 sp=0xc0000fbfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0000fbfe8 sp=0xc0000fbfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 28 [syscall]:
    runtime.cgocall(0x642c10, 0xc00035fd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc00035fd18 sp=0xc00035fce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c826490, 0x7f7a4a61f8b0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc00035fd40 sp=0xc00035fd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000510060?, 0x64?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc00035fd80 sp=0xc00035fd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000510060, {0xc0001641c0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc00035fde0 sp=0xc00035fd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc00035ffb0 sp=0xc00035fde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc00035ffe0 sp=0xc00035ffb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00035ffe8 sp=0xc00035ffe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 29 [syscall]:
    runtime.cgocall(0x642c10, 0xc0000b7d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0000b7d18 sp=0xc0000b7ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c8263d0, 0x7f7a499f3a70)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0000b7d40 sp=0xc0000b7d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0004020f0?, 0x73?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0000b7d80 sp=0xc0000b7d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0004020f0, {0xc000576400?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0000b7de0 sp=0xc0000b7d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0000b7fb0 sp=0xc0000b7de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0000b7fe0 sp=0xc0000b7fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0000b7fe8 sp=0xc0000b7fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 30 [syscall]:
    runtime.cgocall(0x642c10, 0xc000377d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000377d18 sp=0xc000377ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825b30, 0x7f7a49cfcb20)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000377d40 sp=0xc000377d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000510000?, 0x60?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000377d80 sp=0xc000377d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000510000, {0xc0006f84e0?, 0xc0006f84e0?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000377de0 sp=0xc000377d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000377fb0 sp=0xc000377de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000377fe0 sp=0xc000377fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000377fe8 sp=0xc000377fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 31 [syscall]:
    runtime.cgocall(0x642c10, 0xc0006d3d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0006d3d18 sp=0xc0006d3ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825bf0, 0x7f7a499f3bf0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0006d3d40 sp=0xc0006d3d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000398060?, 0x79?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0006d3d80 sp=0xc0006d3d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000398060, {0xc000290300?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0006d3de0 sp=0xc0006d3d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0006d3fb0 sp=0xc0006d3de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0006d3fe0 sp=0xc0006d3fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0006d3fe8 sp=0xc0006d3fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 32 [syscall]:
    runtime.cgocall(0x642c10, 0xc0002c1d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0002c1d18 sp=0xc0002c1ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825f20, 0x7f7a4adee120)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0002c1d40 sp=0xc0002c1d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000398090?, 0x50?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0002c1d80 sp=0xc0002c1d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000398090, {0xc0009744b0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0002c1de0 sp=0xc0002c1d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0002c1fb0 sp=0xc0002c1de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0002c1fe0 sp=0xc0002c1fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0002c1fe8 sp=0xc0002c1fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 33 [syscall]:
    runtime.cgocall(0x642c10, 0xc0007f3d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0007f3d18 sp=0xc0007f3ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c826250, 0x7f7a4a0eb270)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0007f3d40 sp=0xc0007f3d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0003980c0?, 0x61?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0007f3d80 sp=0xc0007f3d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0003980c0, {0xc0003c82a0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0007f3de0 sp=0xc0007f3d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0007f3fb0 sp=0xc0007f3de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0007f3fe0 sp=0xc0007f3fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0007f3fe8 sp=0xc0007f3fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 34 [syscall]:
    runtime.cgocall(0x642c10, 0xc0000d7d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0000d7d18 sp=0xc0000d7ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c8258c0, 0x7f7a4a61f760)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0000d7d40 sp=0xc0000d7d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000398030?, 0x64?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0000d7d80 sp=0xc0000d7d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000398030, {0xc0003067e0?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0000d7de0 sp=0xc0000d7d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0000d7fb0 sp=0xc0000d7de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0000d7fe0 sp=0xc0000d7fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0000d7fe8 sp=0xc0000d7fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 35 [syscall]:
    runtime.cgocall(0x642c10, 0xc000879d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000879d18 sp=0xc000879ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c826160, 0x7f7a4a246000)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000879d40 sp=0xc000879d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000092210?, 0x68?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000879d80 sp=0xc000879d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000092210, {0xc000306460?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000879de0 sp=0xc000879d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000879fb0 sp=0xc000879de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000879fe0 sp=0xc000879fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000879fe8 sp=0xc000879fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 36 [syscall]:
    runtime.cgocall(0x642c10, 0xc000323d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000323d18 sp=0xc000323ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c826640, 0x7f7a499f3cf0)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000323d40 sp=0xc000323d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000610000?, 0x79?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000323d80 sp=0xc000323d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000610000, {0xc000290500?, 0xc000290500?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000323de0 sp=0xc000323d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000323fb0 sp=0xc000323de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000323fe0 sp=0xc000323fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000323fe8 sp=0xc000323fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 37 [syscall]:
    runtime.cgocall(0x642c10, 0xc0001fbd40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc0001fbd18 sp=0xc0001fbce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825cb0, 0x7f7a4a246070)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc0001fbd40 sp=0xc0001fbd18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc0000921e0?, 0x67?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc0001fbd80 sp=0xc0001fbd40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc0000921e0, {0xc000306620?, 0x6b530c?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc0001fbde0 sp=0xc0001fbd80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc0001fbfb0 sp=0xc0001fbde0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc0001fbfe0 sp=0xc0001fbfb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0001fbfe8 sp=0xc0001fbfe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 38 [syscall]:
    runtime.cgocall(0x642c10, 0xc000525d40)
    	/usr/local/go/src/runtime/cgocall.go:157 +0x5c fp=0xc000525d18 sp=0xc000525ce0 pc=0x407b7c
    github.com/hillu/go-yara/v4._Cfunc_yr_scanner_scan_file(0x7f7a4c825e60, 0x7f7a74181f80)
    	_cgo_gotypes.go:1747 +0x4c fp=0xc000525d40 sp=0xc000525d18 pc=0x6262ec
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile.func3(0xc000402090?, 0x79?)
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x4c fp=0xc000525d80 sp=0xc000525d40 pc=0x62b2ac
    github.com/hillu/go-yara/v4.(*Scanner).ScanFile(0xc000402090, {0xc000576080?, 0xc000576080?})
    	/go/pkg/mod/github.com/hillu/go-yara/[email protected]/scanner.go:167 +0x9b fp=0xc000525de0 sp=0xc000525d80 pc=0x62b1bb
    main.processFiles(0x0?, 0x0?, 0x0?, 0x0?)
    	/app/main.go:224 +0x2e5 fp=0xc000525fb0 sp=0xc000525de0 pc=0x63fb85
    main.main.func1()
    	/app/main.go:399 +0x32 fp=0xc000525fe0 sp=0xc000525fb0 pc=0x641892
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000525fe8 sp=0xc000525fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:399 +0xc33
    
    goroutine 39 [chan send]:
    runtime.gopark(0x203000?, 0xc0005d4080?, 0x0?, 0x0?, 0xc0001177e0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000117780 sp=0xc000117760 pc=0x43a956
    runtime.chansend(0xc000016180, 0xc000117870, 0x1, 0x4c?)
    	/usr/local/go/src/runtime/chan.go:258 +0x425 fp=0xc000117808 sp=0xc000117780 pc=0x409e85
    runtime.chansend1(0xc0006f8840?, 0x52?)
    	/usr/local/go/src/runtime/chan.go:144 +0x1d fp=0xc000117838 sp=0xc000117808 pc=0x409a3d
    main.scanDir.func1({0xc0006f8840, 0x52}, {0x77a8d8, 0xc00049d110}, {0x100?, 0xffffffffffffff9c?})
    	/app/main.go:253 +0x1b6 fp=0xc0001178d0 sp=0xc000117838 pc=0x640076
    path/filepath.walk({0xc0006f8840, 0x52}, {0x77a8d8, 0xc00049d110}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:418 +0x123 fp=0xc000117998 sp=0xc0001178d0 pc=0x582963
    path/filepath.walk({0xc00011cd70, 0x48}, {0x77a8d8, 0xc000160a90}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117a60 sp=0xc000117998 pc=0x582ac5
    path/filepath.walk({0xc00011e040, 0x3c}, {0x77a8d8, 0xc0001bc1a0}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117b28 sp=0xc000117a60 pc=0x582ac5
    path/filepath.walk({0xc0007be120, 0x30}, {0x77a8d8, 0xc000169a00}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117bf0 sp=0xc000117b28 pc=0x582ac5
    path/filepath.walk({0xc0000ea030, 0x27}, {0x77a8d8, 0xc0008672b0}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117cb8 sp=0xc000117bf0 pc=0x582ac5
    path/filepath.walk({0xc00049e0c0, 0x18}, {0x77a8d8, 0xc00049dd40}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117d80 sp=0xc000117cb8 pc=0x582ac5
    path/filepath.walk({0xc0008345e0, 0x10}, {0x77a8d8, 0xc000866d00}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117e48 sp=0xc000117d80 pc=0x582ac5
    path/filepath.walk({0x7fffdb217f31, 0x5}, {0x77a8d8, 0xc00007d6c0}, 0xc000117f88)
    	/usr/local/go/src/path/filepath/path.go:442 +0x285 fp=0xc000117f10 sp=0xc000117e48 pc=0x582ac5
    path/filepath.Walk({0x7fffdb217f31, 0x5}, 0xc000312788)
    	/usr/local/go/src/path/filepath/path.go:505 +0x6c fp=0xc000117f60 sp=0xc000117f10 pc=0x582c2c
    main.scanDir({0x7fffdb217f31?, 0x0?}, 0xc000016180, 0x0?)
    	/app/main.go:258 +0x4d fp=0xc000117fb0 sp=0xc000117f60 pc=0x63fe4d
    main.main.func2()
    	/app/main.go:401 +0x32 fp=0xc000117fe0 sp=0xc000117fb0 pc=0x641832
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000117fe8 sp=0xc000117fe0 pc=0x4667a1
    created by main.main
    	/app/main.go:401 +0xda5
    
    goroutine 50 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00030c758 sp=0xc00030c738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00030c7e0 sp=0xc00030c758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00030c7e8 sp=0xc00030c7e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 66 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000310f58 sp=0xc000310f38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc000310fe0 sp=0xc000310f58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000310fe8 sp=0xc000310fe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 67 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066e758 sp=0xc00066e738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066e7e0 sp=0xc00066e758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066e7e8 sp=0xc00066e7e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 68 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066ef58 sp=0xc00066ef38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066efe0 sp=0xc00066ef58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066efe8 sp=0xc00066efe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 69 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066f758 sp=0xc00066f738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066f7e0 sp=0xc00066f758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066f7e8 sp=0xc00066f7e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 70 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066ff58 sp=0xc00066ff38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066ffe0 sp=0xc00066ff58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066ffe8 sp=0xc00066ffe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 71 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000670758 sp=0xc000670738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc0006707e0 sp=0xc000670758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0006707e8 sp=0xc0006707e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 72 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000670f58 sp=0xc000670f38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc000670fe0 sp=0xc000670f58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000670fe8 sp=0xc000670fe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 73 [GC worker (idle)]:
    runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000671758 sp=0xc000671738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc0006717e0 sp=0xc000671758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc0006717e8 sp=0xc0006717e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 74 [GC worker (idle)]:
    runtime.gopark(0x2684da3a7b2f?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc000671f58 sp=0xc000671f38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc000671fe0 sp=0xc000671f58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc000671fe8 sp=0xc000671fe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 75 [GC worker (idle)]:
    runtime.gopark(0x2684da4e67dc?, 0x0?, 0x0?, 0x0?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066a758 sp=0xc00066a738 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066a7e0 sp=0xc00066a758 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066a7e8 sp=0xc00066a7e0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    
    goroutine 76 [GC worker (idle)]:
    runtime.gopark(0x2684da3a35cb?, 0x1?, 0xcb?, 0x30?, 0x0?)
    	/usr/local/go/src/runtime/proc.go:361 +0xd6 fp=0xc00066af58 sp=0xc00066af38 pc=0x43a956
    runtime.gcBgMarkWorker()
    	/usr/local/go/src/runtime/mgc.go:1207 +0xe5 fp=0xc00066afe0 sp=0xc00066af58 pc=0x41f745
    runtime.goexit()
    	/usr/local/go/src/runtime/asm_amd64.s:1571 +0x1 fp=0xc00066afe8 sp=0xc00066afe0 pc=0x4667a1
    created by runtime.gcBgMarkStartWorkers
    	/usr/local/go/src/runtime/mgc.go:1131 +0x25
    

    I'm going to guess the last tested file caused the crash, and has 21443 chars in one line. Tested after the update and worked without issue.

    Merge request coming in a few minutes.

    opened by BaderSZ 1
  • Added support for white-spaces in target

    Added support for white-spaces in target

    It might have something to do with the fact that I run on WSL2 (or me being stupid). However, if the target directory for searching contains whitespace (no matter if they are escaped using "/some path/dir" or /some \path/dir" it causes errors.

    Examples:

    • Without this patch:

      • Sample 1 Input: /c/Users/User/source/php-malware-finder/php-malware-finder/phpmalwarefinder -c "/c/Users/User/source/php-malware-finder/php-malware-finder/php.yar" -t 4 ~/white\ space\ test/php_malware_finder/test_1/ Output: error: could not open file: /home/alex/white
      • Sample 2 Input: /c/Users/User/source/php-malware-finder/php-malware-finder/phpmalwarefinder -c "/c/Users/User/source/php-malware-finder/php-malware-finder/php.yar" -t 4 "white space test/php_malware_finder/test_1" Output: error: could not open file: white
    • With this patch:

      • Sample 1 Input: /c/Users/User/source/php-malware-finder/php-malware-finder/phpmalwarefinder -c "/c/Users/User/source/php-malware-finder/php-malware-finder/php.yar" -t 4 ~/white\ space\ test/php_malware_finder/test_1/ Output (as expected): DodgyPhp /home/alex/white space test/php_malware_finder/test_1/aboba.php ObfuscatedPhp /home/alex/white space test/php_malware_finder/test_1/SendMonthlyTaskListCompletionReminder.php
      • Sample 2: Input: /c/Users/User/source/php-malware-finder/php-malware-finder/phpmalwarefinder -c "/c/Users/User/source/php-malware-finder/php-malware-finder/php.yar" -t 4 "white space test/php_malware_finder/test_1" Output (as expected): DodgyPhp /home/alex/white space test/php_malware_finder/test_1/aboba.php ObfuscatedPhp /home/alex/white space test/php_malware_finder/test_1/SendMonthlyTaskListCompletionReminder.php
    opened by DobroAlex 0
  • generate-whitelist.py - multiple issues on centos 6.10

    generate-whitelist.py - multiple issues on centos 6.10

    Hi,

    missing encoding :

    ./generate_whitelist.py test_jeff /var/www/html/test/
      File "./generate_whitelist.py", line 4
    SyntaxError: Non-ASCII character '\xe2' in file ./generate_whitelist.py on line 4, but no encoding declared; see http://www.python.org/peps/pep-0263.html for details
    
    

    so I set #coding=UTF-8 at the beginning of the script

    After that, I ran

    ./generate_whitelist.py test_jeff /var/www/html/test/

    and got

    Can't compile rules: (..)php-malware-finder-master/php-malware-finder/utils/../php.yar(377): undefined identifier "IsWhitelisted"

    This isWhitelisted identifier is defined in whitelists.yar.

    Could you please make code changes so that this tools works or help me make it work as you expect ?

    Thanks in advance.

    opened by jeffchulg 4
Owner
NBS System
Secure Cloud Operator
NBS System
PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application

PHPIDS PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web ap

null 752 Jan 3, 2023
php-chmod is a PHP library for easily changing permissions recursively.

PHP chmod php-chmod is a PHP library for easily changing the permissions recursively. Versions & Dependencies Version PHP Documentation ^1.1 ^7.4 curr

Mathias Reker ⚡️ 5 Oct 7, 2022
PHP 5.x support for random_bytes() and random_int()

random_compat PHP 5.x polyfill for random_bytes() and random_int() created and maintained by Paragon Initiative Enterprises. Although this library sho

Paragon Initiative Enterprises 8k Jan 5, 2023
PHP Secure Communications Library

phpseclib - PHP Secure Communications Library Supporting phpseclib Become a backer or sponsor on Patreon One-time donation via PayPal or crypto-curren

null 4.9k Jan 7, 2023
Simple Encryption in PHP.

php-encryption composer require defuse/php-encryption This is a library for encrypting data with a key or password in PHP. It requires PHP 5.6 or new

Taylor Hornby 3.6k Jan 3, 2023
Standards compliant HTML filter written in PHP

HTML Purifier HTML Purifier is an HTML filtering solution that uses a unique combination of robust whitelists and aggressive parsing to ensure that no

Edward Z. Yang 2.7k Jan 5, 2023
A database of PHP security advisories

PHP Security Advisories Database The PHP Security Advisories Database references known security vulnerabilities in various PHP projects and libraries.

null 1.9k Dec 18, 2022
A php.ini scanner for best security practices

Scanner for PHP.ini The Iniscan is a tool designed to scan the given php.ini file for common security practices and report back results. Currently it

psec.io 1.5k Dec 5, 2022
🤖 Id obfuscation based on Knuth's multiplicative hashing method for PHP.

Optimus id transformation With this library, you can transform your internal id's to obfuscated integers based on Knuth's integer hash. It is similar

Jens Segers 1.2k Jan 2, 2023
㊙️ AntiXSS | Protection against Cross-site scripting (XSS) via PHP

㊙️ AntiXSS "Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications. XSS enables attackers to inje

Lars Moelleken 570 Dec 16, 2022
An experimental object oriented SSH api in PHP

PHP SSH (master) Provides an object-oriented wrapper for the php ssh2 extension. Requirements You need PHP version 5.3+ with the SSH2 extension. Insta

Antoine Hérault 355 Dec 6, 2022
TCrypto is a simple and flexible PHP 5.3+ in-memory key-value storage library

About TCrypto is a simple and flexible PHP 5.3+ in-memory key-value storage library. By default, a cookie will be used as a storage backend. TCrypto h

timoh 57 Dec 2, 2022
Fetches random integers from random.org instead of using PHP's PRNG implementation

TrulyRandom Composer-compatible library to interact with random.org's API in order to generate truly random lists of integers, sequences of integers,

Erik Wurzer 46 Nov 25, 2022
PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

PHPGGC: PHP Generic Gadget Chains PHPGGC is a library of unserialize() payloads along with a tool to generate them, from command line or programmatica

Ambionics Security 2.5k Jan 4, 2023
Let's Encrypt/ACME Command Line client written in PHP

Acme PHP Acme PHP is a simple yet very extensible CLI client for Let's Encrypt that will help you get and renew free HTTPS certificates. Acme PHP is a

Acme PHP 539 Dec 30, 2022
Compatibility with the password_* functions that ship with PHP 5.5

password_compat This library is intended to provide forward compatibility with the password_* functions that ship with PHP 5.5. See the RFC for more d

Anthony Ferrara 2.2k Dec 30, 2022
A petite library of encryption functions for PHP

?? dcrypt A petite library of essential encryption functions for PHP 7.1+. For legacy PHP version support, look here. If you need a dcrypt inspired en

null 96 Oct 6, 2022
A proof of concept of a PHP Miner that can mine DuinoCoin

Duino Coin - PHP Miner This is a proof of concept. This miner is provided as is, with no guarantee it will work as intended for you.

Ricardo Fiorani 10 Sep 7, 2022
Port scanning using PHP!

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ?? Scanner Port's ?? ???? Don't forget to leave a star! ⭐ ???? Não se esqueça de deixar uma estrela! ⭐ ?? Credits | Créd

Hellen. 4 Feb 26, 2022