add Falcon flag

KTibow · Jan 23, 2024 · c103022 · c103022
1 parent 3cb4484
commit c103022
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/src/lib/analysis/runAnalysis.ts b/src/lib/analysis/runAnalysis.ts
@@ -103,6 +103,10 @@ const scan = (file: string, contents: string, state: Analysis) => {
     state.obfuscation["Obfuscator Stringer"] = { file };
   }
 
+  if (contents.includes("Falcon is downloading classes...")) {
+    state.obfuscation["Downloads remote content"] = { file };
+  }
+
   const addFlag = (name: string, data: { link?: string; initialFind: InitialFind }) => {
     if (state.flags[name]) {
       state.flags[name].matches.push(file);