CVE-2022-41547: Insufficient Information (NVD-CWE-noinfo)
value: Mobile Security Framework (MobSF) v0.9.2 and below was discovered to contain a local file inclusion (LFI) vulnerability in the StaticAnalyzer/views.py script. This vulnerability allows attackers to read arbitrary files via a crafted HTTP request.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2022-10-18T15:15Z
Repository: https://github.com/MobSF/Mobile-Security-Framework-MobSF
Language: Python
Files changed: APITester/views.py, DynamicAnalyzer/views.py, MalwareAnalyzer/malwaredb/malwaredomainlist, StaticAnalyzer/views.py
Commit date: 2016-05-26 19:17:30 +0530
Commit message: Security: Fix for LFI found by thongngo

Diff: diff --git a/APITester/views.py b/APITester/views.py
index e1ef6bd..14244d0 100644
--- a/APITester/views.py
+++ b/APITester/views.py
@@ -46,11 +46,11 @@ def APIFuzzer(request):
     global TESTS
     print "\n[INFO] API Testing Started"
     try:
         if request.method == 'GET':
             MD5=request.GET['md5']
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 URLS = getListOfURLS(MD5,False)
                 if (len(URLS)) == 0:
                     return HttpResponseRedirect('/NoAPI/')
                 context = {'title' : 'API Tester',
@@ -69,11 +69,11 @@ def APIFuzzer(request):
                 return render(request,template,context)
             else:
                 return HttpResponseRedirect('/error/')
         elif request.method =="POST":
             MD5=request.POST['md5']
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 SCOPE_URLS = [] #All DOMAINS that needs to be tested
                 SCOPE_TESTS = [] #All TESTS that needs to be executed
                 DICT_URLS = {} # {domain:{url1,url2}, domain2:{url1,url2,url3}}
 
@@ -126,11 +126,11 @@ def APIFuzzer(request):
 def StartScan(request):
     print "\n[INFO] Web API Scan Started"
     try:
         if request.method =="POST":
             MD5=request.POST['md5']
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 #Scan Mode
                 SCAN_MODE=request.POST['scanmode']
                 URLS_CONF = {}
                 #Untrusted User Input
diff --git a/DynamicAnalyzer/views.py b/DynamicAnalyzer/views.py
index 9e3425b..c5f40d6 100644
--- a/DynamicAnalyzer/views.py
+++ b/DynamicAnalyzer/views.py
@@ -36,11 +36,11 @@ def DynamicAnalyzer(request):
             PKG=request.POST['pkg']
             LNCH=request.POST['lng']
             if re.findall(";|\$\(|\|\||&&",PKG) or re.findall(";|\$\(|\|\||&&",LNCH):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/') 
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 # Delete ScreenCast Cache
                 SCREEN_FILE=os.path.join(settings.SCREEN_DIR, 'screen.png')
                 if os.path.exists(SCREEN_FILE):
                     os.remove(SCREEN_FILE)
@@ -80,11 +80,11 @@ def GetEnv(request):
             PKG=request.POST['pkg']
             LNCH=request.POST['lng']
             if re.findall(";|\$\(|\|\||&&",PKG) or re.findall(";|\$\(|\|\||&&",LNCH):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/') 
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 DIR=settings.BASE_DIR
                 APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
                 APP_FILE=MD5 + '.apk'        #NEW FILENAME
                 APP_PATH=APP_DIR+APP_FILE    #APP PATH
@@ -111,11 +111,11 @@ def GetEnv(request):
 def TakeScreenShot(request):
     print "\n[INFO] Taking Screenshot"
     try:
         if request.method == 'POST':
             MD5=request.POST['md5']
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 data = {}
                 r=random.randint(1, 1000000)
                 DIR=settings.BASE_DIR
                 SCRDIR=os.path.join(settings.UPLD_DIR, MD5+'/screenshots-apk/')#make sure that list only png from this directory
@@ -261,11 +261,11 @@ def FinalTest(request):
             MD5=request.POST['md5']
             PACKAGE=request.POST['pkg']
             if re.findall(";|\$\(|\|\||&&",PACKAGE):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/') 
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 #Stop ScreenCast Client if it is running
                 tcp_server_mode = "off"
                 DIR=settings.BASE_DIR
                 APKDIR=os.path.join(settings.UPLD_DIR, MD5+'/')
@@ -305,11 +305,11 @@ def DumpData(request):
     try:
         if request.method == 'POST':
             data = {}
             PACKAGE=request.POST['pkg']
             MD5=request.POST['md5']
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 if re.findall(";|\$\(|\|\||&&",PACKAGE):
                     print "[ATTACK] Possible RCE"
                     return HttpResponseRedirect('/error/')
                 DIR=settings.BASE_DIR
@@ -351,11 +351,11 @@ def DumpData(request):
 def ExportedActivityTester(request):
     print "\n[INFO] Exported Activity Tester"
     try:
         MD5=request.POST['md5']
         PKG=request.POST['pkg']
-        m=re.match('[0-9a-f]{32}',MD5)
+        m=re.match('^[0-9a-f]{32}$',MD5)
         if m:
             if re.findall(";|\$\(|\|\||&&",PKG):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/')
             if request.method == 'POST':
@@ -408,11 +408,11 @@ def ExportedActivityTester(request):
 def ActivityTester(request):
     print "\n[INFO] Activity Tester"
     try:
         MD5=request.POST['md5']
         PKG=request.POST['pkg']
-        m=re.match('[0-9a-f]{32}',MD5)
+        m=re.match('^[0-9a-f]{32}$',MD5)
         if m:
             if re.findall(";|\$\(|\|\||&&",PKG):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/')
             if request.method == 'POST':
@@ -471,11 +471,11 @@ def Report(request):
             MD5=request.GET['md5']
             PKG=request.GET['pkg']
             if re.findall(";|\$\(|\|\||&&",PKG):
                 print "[ATTACK] Possible RCE"
                 return HttpResponseRedirect('/error/') 
-            m=re.match('[0-9a-f]{32}',MD5)
+            m=re.match('^[0-9a-f]{32}$',MD5)
             if m:
                 DIR=settings.BASE_DIR
                 APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
                 DWD_DIR=settings.DWD_DIR
                 DRDMONAPISLOC=os.path.join(APP_DIR,'x_logcat.txt') #Use check_outputs instead later.
@@ -889,11 +889,11 @@ def View(request):
     try:
         typ=''
         fil=''
         rtyp=''
         dat=''
-        m=re.match('[0-9a-f]{32}',request.GET['md5'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
         if m:
             fil=request.GET['file']
             MD5=request.GET['md5']
             typ=request.GET['type']
             SRC=os.path.join(settings.UPLD_DIR, MD5+'/DYNAMIC_DeviceData/')
diff --git a/MalwareAnalyzer/malwaredb/malwaredomainlist b/MalwareAnalyzer/malwaredb/malwaredomainlist
index 9899945..6c208ee 100644
--- a/MalwareAnalyzer/malwaredb/malwaredomainlist
+++ b/MalwareAnalyzer/malwaredb/malwaredomainlist
@@ -3036,6 +3036,30 @@
 "2016/05/12_08:01","hitechtattoos.com/wp-includes/SimplePie/il5vOt.html","192.185.236.182","-","Compromised site, leads to Locky","-","46606","0","US",
 "2016/05/12_08:01","myfavoriteviolincd.com/sibelius/tagnvatz/Xw7P8j.html","192.254.236.109","-","Compromised site, leads to Locky","Registrant MAESTRI@RAMBLER.RU","46606","0","US",
 "2016/05/12_08:01","oceanviewfootmassage.com/js/BKTbCv.html","192.254.225.146","-","Compromised site, leads to Locky","Registrar Abuse Contact abuse@1and1.com","46606","0","US",
 "2016/05/12_08:36","www.airsonett.se","193.44.13.93","193-44-13-93.net.tnm.se.","pseudo darkleech on compromised site leads to Angler EK","-","3301","0","SE",
 "2016/05/12_09:49","chashmawala.com/mn3yhds","142.4.1.197","142-4-1-197.unifiedlayer.com.","Locky ransomware","-","46606","0","US",
-"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws."
\ No newline at end of file
+"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws.","Locky ransomware","-","27715","0","BR",
+"2016/05/12_10:40","scrubs.dresscool.co/zcv3hhs","107.180.25.1","ip-107-180-25-1.ip.secureserver.net.","Locky ransomware","dresscool.co@domainsbyproxy.com","26496","0","US",
+"2016/05/12_12:39","www.jobbainorge.nu/","195.74.38.95","cl-11.atm.binero.net.","pseudo darkleech on compromised site leads to Angler EK","-","41528","0","SE",
+"2016/05/12_12:39","microencapsulation.readmyweather.com/satire/pairing/58798892_pkfpfGESM","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Registrar Abuse Contact support@domainbox.com","46475","0","US",
+"2016/05/12_14:22","www.autoappassionati.it/","109.233.126.14","cpanel01.infinitynet.it.","pseudo darkleech on compromised site leads to Angler EK","-","48815","0","IT",
+"2016/05/12_14:23","tannpastnevicher.themakershop.co.uk/mj/o/3557/","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Colyton Industrial Designs ltd / -","46475","0","US",
+"2016/05/13_13:23","www.imageprecision.com/","188.121.41.53","n1nw8shg125.shr.prod.ams1.secureserver.net.","pseudo darkleech on compromised site leads to Angler EK","-","26496","0","NL",
+"2016/05/13_13:23","arbeiderspartij.be-spry.co.uk/NTQBuUVxO/gXyyX/IobVvqD-pRXCfMd/","85.25.41.91","static-ip-85-25-41-91.inaddr.ip-pool.com.","Angler EK","H R Searle / -","8972","0","DE",
+"2016/05/15_15:23","meuble-ligansadaequabat.thepinkskip.co.uk/hoteliers/6719/66/01/511758321.html","188.165.167.255","-","Angler EK","Brian Barr / -","16276","0","FR",
+"2016/05/16_10:40","sign.cdrn70.xyz/hfziso4.html","93.190.140.154","-","gateway to Angler EK","-","49981","0","NL",
+"2016/05/16_11:15","inclination.cdrn70.xyz/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
+"2016/05/16_11:51","no-id.eu/987t5t7g","83.137.194.81","server6.hosting2go.nl.","trojan","NOT DISCLOSED! / -","34233","0","NL",
+"2016/05/16_11:55","press.centraljoias.com/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrant flavio.dygo@gmail.com","49981","0","NL",
+"2016/05/16_12:00","gutter.celebway.net/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrar Abuse Contact abuse@bizcn.com","49981","0","NL",
+"2016/05/16_12:35","charge.cenzorate-expertize.ro/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
+"2016/05/16_12:40","excitable.charmedmultimedia.eu/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","NOT DISCLOSED! / -","49981","0","NL",
+"2016/05/16_18:05","sunlite.com.au/j76jn5nbv","27.124.119.225","server-69-r12.ipv4.au.syrahost.com.","Locky ransomware","Wayne Hughes / Visit whois.ausregistry.com.au for Web based WhoIs","38719","0","AU",
+"2016/05/17_07:17","uwzorg.info/k76gf34g4g","89.105.197.30","mail.teurlings.biz.","Locky ransomware","MAM Teurlings / webmaster@teurlings.biz","24875","0","NL",
+"2016/05/17_09:54","actinomorphous.excelwood.co.uk/euNsbCci/FAUk/Olvp/82749/SAitPlttYB-35817144-hgs.png","37.130.229.104","uk.server.","Angler EK","Decora Blind Systems / -","13213","0","GB",
+"2016/05/17_10:32","www.gptecno.it/","178.255.186.250","www010.avanzati.it.","pseudo darkleech on compromised site leads to Angler EK","-","42425","0","IT",
+"2016/05/17_10:32","armstrongcreekgeleedpotig.imber.me.uk/VDBGs/ftPRd/ZXyG-lBfzftj/","37.130.229.104","uk.server.","Angler EK","Nominet UK / -","13213","0","GB",
+"2016/05/17_13:34","passagegoldtravel.com/678y8h","23.229.182.198","ip-23-229-182-198.ip.secureserver.net.","Locky ransomware","-","26496","0","US",
+"2016/05/18_07:28","spreadware.com/09jhg54g","162.244.95.27","-","Locky ransomware","Registrar Abuse Contact abuse@namesilo.com","53667","0","US",
+"2016/05/18_15:05","www.cafecalluna.nl/","193.239.186.142","sweb02.plinq.nl.","pseudo darkleech on compromised site leads to Angler EK","-","35224","0","NL",
+"2016/05/18_15:05","brunowtrahoque-miagola.unishadeverticalsystem.com/1331481-positivity-misdiagnosis-refrigerants-slim-twinkles-array.png","63.143.54.198","198-54-143-63.static.reverse.lstn.
\ No newline at end of file
diff --git a/StaticAnalyzer/views.py b/StaticAnalyzer/views.py
index cf2e4d7..981474b 100644
--- a/StaticAnalyzer/views.py
+++ b/StaticAnalyzer/views.py
@@ -32,11 +32,11 @@ def key(d, key_name):
 
 def PDF(request):
     try:
         MD5=request.GET['md5']
         TYP=request.GET['type']
-        m=re.match('[0-9a-f]{32}',MD5)
+        m=re.match('^[0-9a-f]{32}$',MD5)
         if m:
             if (TYP=='APK' or TYP=='ANDZIP'):
                 DB=StaticAnalyzerAndroid.objects.filter(MD5=MD5)
                 if DB.exists():
                     print "\n[INFO] Fetching data from DB for PDF Report Generation (Android)"
@@ -157,11 +157,11 @@ def PDF(request):
         PrintException("[ERROR] PDF Report Generation Error")
         return HttpResponseRedirect('/error/') 
         pass
 def Java(request):
     try:
-        m=re.match('[0-9a-f]{32}',request.GET['md5'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
         typ=request.GET['type']
         if m:
             MD5=request.GET['md5']
             if typ=='eclipse':
                 SRC=os.path.join(settings.UPLD_DIR, MD5+'/src/')
@@ -196,11 +196,11 @@ def Java(request):
     except:
         PrintException("[ERROR] Getting Java Files")
         return HttpResponseRedirect('/error/')
 def Smali(request):
     try:
-        m=re.match('[0-9a-f]{32}',request.GET['md5'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
         if m:
             MD5=request.GET['md5']
             SRC=os.path.join(settings.UPLD_DIR, MD5+'/smali_source/')
             html=''
             for dirName, subDir, files in os.walk(SRC):
@@ -222,11 +222,11 @@ def Smali(request):
     except:
         PrintException("[ERROR] Getting Smali Files")
         return HttpResponseRedirect('/error/')
 def Find(request):
     try:
-        m=re.match('[0-9a-f]{32}',request.POST['md5'])
+        m=re.match('^[0-9a-f]{32}$',request.POST['md5'])
         if m:
             MD5=request.POST['md5']
             q=request.POST['q']
             code=request.POST['code']
             matches=[]
@@ -263,11 +263,11 @@ def Find(request):
         PrintException("[ERROR] Searching Failed")
         return HttpResponseRedirect('/error/')     
 def ViewSource(request):
     try:
         fil=''
-        m=re.match('[0-9a-f]{32}',request.GET['md5'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
         if m and (request.GET['file'].endswith('.java') or request.GET['file'].endswith('.smali')):
             fil=request.GET['file']
             MD5=request.GET['md5']
             if (("../" in fil) or ("%2e%2e" in fil) or (".." in fil) or ("%252e" in fil)):
                 return HttpResponseRedirect('/error/')
@@ -302,11 +302,11 @@ def ManifestView(request):
     try:
         DIR=settings.BASE_DIR   #BASE DIR
         MD5=request.GET['md5']  #MD5
         TYP=request.GET['type'] #APK or SOURCE
         BIN=request.GET['bin']
-        m=re.match('[0-9a-f]{32}',MD5)
+        m=re.match('^[0-9a-f]{32}$',MD5)
         if m and (TYP=='eclipse' or TYP=='studio' or TYP=='apk') and (BIN=='1' or BIN=='0'):
             APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
             TOOLS_DIR=os.path.join(DIR, 'StaticAnalyzer/tools/')  #TOOLS DIR
             if BIN=='1':
                 x=True
@@ -324,11 +324,11 @@ def ManifestView(request):
 
 def StaticAnalyzer(request):
     try:
         #Input validation
         TYP=request.GET['type']
-        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
         if ((m) and (request.GET['name'].lower().endswith('.apk') or request.GET['name'].lower().endswith('.zip')) and ((TYP=='zip') or (TYP=='apk'))):
             DIR=settings.BASE_DIR        #BASE DIR
             APP_NAME=request.GET['name'] #APP ORGINAL NAME
             MD5=request.GET['checksum']  #MD5
             APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
@@ -1752,11 +1752,11 @@ def StaticAnalyzer_iOS(request):
     try:
         #Input validation
         print "[INFO] iOS Static Analysis Started"
         TYP=request.GET['type']
         RESCAN= str(request.GET.get('rescan', 0))
-        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
+        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
         if ((m) and (request.GET['name'].lower().endswith('.ipa') or request.GET['name'].lower().endswith('.zip')) and ((TYP=='ipa') or (TYP=='ios'))):
             DIR=settings.BASE_DIR        #BASE DIR
             APP_NAME=request.GET['name'] #APP ORGINAL NAME
             MD5=request.GET['checksum']  #MD5
             APP_DIR=os.path.join(settings.UPLD_DIR, MD5+'/') #APP DIRECTORY
@@ -1961,11 +1961,11 @@ def ViewFile(request):
         print "[INFO] View iOS Files"
         fil=request.GET['file']
         typ=request.GET['type']
         MD5=request.GET['md5']
         mode=request.GET['mode']
-        m=re.match('[0-9a-f]{32}',MD5)
+        m=re.match('^[0-9a-f]{32}$',MD5)
         ext=fil.split('.')[-1]
         f=re.search("plist|db|sqlitedb|sqlite|txt|m",ext)
         if m and f and re.findall('xml|db|txt|m',typ) and re.findall('ios|ipa',mode):
             if (("../" in fil) or ("%2e%2e" in fil) or (".." in fil) or ("%252e" in fil)):
                 return HttpResponseRedirect('/error/')

Vulnerable code:             m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',MD5)
            m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws."
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',request.POST['md5'])
        m=re.match('[0-9a-f]{32}',request.GET['md5'])
        m=re.match('[0-9a-f]{32}',MD5)
        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
        m=re.match('[0-9a-f]{32}',request.GET['checksum'])
        m=re.match('[0-9a-f]{32}',MD5)
Fixed code:             m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',MD5)
            m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
"2016/05/12_10:40","lojasrana.com:7080/ujh3jmd","186.202.183.138","pleskcl0243.hospedagemdesites.ws.","Locky ransomware","-","27715","0","BR",
"2016/05/12_10:40","scrubs.dresscool.co/zcv3hhs","107.180.25.1","ip-107-180-25-1.ip.secureserver.net.","Locky ransomware","dresscool.co@domainsbyproxy.com","26496","0","US",
"2016/05/12_12:39","www.jobbainorge.nu/","195.74.38.95","cl-11.atm.binero.net.","pseudo darkleech on compromised site leads to Angler EK","-","41528","0","SE",
"2016/05/12_12:39","microencapsulation.readmyweather.com/satire/pairing/58798892_pkfpfGESM","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Registrar Abuse Contact support@domainbox.com","46475","0","US",
"2016/05/12_14:22","www.autoappassionati.it/","109.233.126.14","cpanel01.infinitynet.it.","pseudo darkleech on compromised site leads to Angler EK","-","48815","0","IT",
"2016/05/12_14:23","tannpastnevicher.themakershop.co.uk/mj/o/3557/","69.162.126.172","172-126-162-69.static.reverse.lstn.net.","Angler EK","Colyton Industrial Designs ltd / -","46475","0","US",
"2016/05/13_13:23","www.imageprecision.com/","188.121.41.53","n1nw8shg125.shr.prod.ams1.secureserver.net.","pseudo darkleech on compromised site leads to Angler EK","-","26496","0","NL",
"2016/05/13_13:23","arbeiderspartij.be-spry.co.uk/NTQBuUVxO/gXyyX/IobVvqD-pRXCfMd/","85.25.41.91","static-ip-85-25-41-91.inaddr.ip-pool.com.","Angler EK","H R Searle / -","8972","0","DE",
"2016/05/15_15:23","meuble-ligansadaequabat.thepinkskip.co.uk/hoteliers/6719/66/01/511758321.html","188.165.167.255","-","Angler EK","Brian Barr / -","16276","0","FR",
"2016/05/16_10:40","sign.cdrn70.xyz/hfziso4.html","93.190.140.154","-","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_11:15","inclination.cdrn70.xyz/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_11:51","no-id.eu/987t5t7g","83.137.194.81","server6.hosting2go.nl.","trojan","NOT DISCLOSED! / -","34233","0","NL",
"2016/05/16_11:55","press.centraljoias.com/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrant flavio.dygo@gmail.com","49981","0","NL",
"2016/05/16_12:00","gutter.celebway.net/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","Registrar Abuse Contact abuse@bizcn.com","49981","0","NL",
"2016/05/16_12:35","charge.cenzorate-expertize.ro/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","-","49981","0","NL",
"2016/05/16_12:40","excitable.charmedmultimedia.eu/brhsc4.html","93.190.140.219","s10.sheermail.com.","gateway to Angler EK","NOT DISCLOSED! / -","49981","0","NL",
"2016/05/16_18:05","sunlite.com.au/j76jn5nbv","27.124.119.225","server-69-r12.ipv4.au.syrahost.com.","Locky ransomware","Wayne Hughes / Visit whois.ausregistry.com.au for Web based WhoIs","38719","0","AU",
"2016/05/17_07:17","uwzorg.info/k76gf34g4g","89.105.197.30","mail.teurlings.biz.","Locky ransomware","MAM Teurlings / webmaster@teurlings.biz","24875","0","NL",
"2016/05/17_09:54","actinomorphous.excelwood.co.uk/euNsbCci/FAUk/Olvp/82749/SAitPlttYB-35817144-hgs.png","37.130.229.104","uk.server.","Angler EK","Decora Blind Systems / -","13213","0","GB",
"2016/05/17_10:32","www.gptecno.it/","178.255.186.250","www010.avanzati.it.","pseudo darkleech on compromised site leads to Angler EK","-","42425","0","IT",
"2016/05/17_10:32","armstrongcreekgeleedpotig.imber.me.uk/VDBGs/ftPRd/ZXyG-lBfzftj/","37.130.229.104","uk.server.","Angler EK","Nominet UK / -","13213","0","GB",
"2016/05/17_13:34","passagegoldtravel.com/678y8h","23.229.182.198","ip-23-229-182-198.ip.secureserver.net.","Locky ransomware","-","26496","0","US",
"2016/05/18_07:28","spreadware.com/09jhg54g","162.244.95.27","-","Locky ransomware","Registrar Abuse Contact abuse@namesilo.com","53667","0","US",
"2016/05/18_15:05","www.cafecalluna.nl/","193.239.186.142","sweb02.plinq.nl.","pseudo darkleech on compromised site leads to Angler EK","-","35224","0","NL",
"2016/05/18_15:05","brunowtrahoque-miagola.unishadeverticalsystem.com/1331481-positivity-misdiagnosis-refrigerants-slim-twinkles-array.png","63.143.54.198","198-54-143-63.static.reverse.lstn.
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',request.POST['md5'])
        m=re.match('^[0-9a-f]{32}$',request.GET['md5'])
        m=re.match('^[0-9a-f]{32}$',MD5)
        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
        m=re.match('^[0-9a-f]{32}$',request.GET['checksum'])
        m=re.match('^[0-9a-f]{32}$',MD5)