EncFind

Technical summary

EncFind was built for operational malware triage in PHP-centric hosting stacks. Its detection engine combines static signatures, contextual heuristics, and decode-to-execution chain analysis (for example base64_decode reaching eval) to assign a 0-100 risk score with explicit reasoning.

Implemented technical scope

• Python rewrite/enhancement of legacy ecpp_2.pl workflow.
• Multi-layer scoring:

- known webshell signatures, - dynamic execution heuristics, - decode-depth and execution sink reachability.

• Context-aware detection to separate:

- executable code, - string/comment/simulation content.

• Optional integrations:

- local YARA, - remote YARA (Abuse.ch), - VirusTotal hash lookups, - Wordfence CLI findings.

• Output modes for mixed audiences:

- simple, technical, executive.

• Export formats: JSON, CSV, HTML.
• Baseline and allowlist workflow for noise control.

Installation and requirements

# core runtime
python3 --version

# project dependencies
pip install -r requeriments.txt

# optional: wordfence cli
python3 -m pip install git+https://github.com/wordfence/wordfence-cli.git

Practical execution examples

1) Standard local scan

python3 encfind.py -d /home/user/public_html/

2) Full multi-engine scan

python3 encfind.py -d /home/user/public_html \
  --vt --yara --wordfence --wordfence-accept-terms \
  --export-html report.html

3) Strict production mode

python3 encfind.py -d /home/user/public_html/ --strict --only-actionable

4) Sensitive audit mode

python3 encfind.py -d /home/user/public_html/ --audit

Operational diagnostics delivered

• Risk-per-finding (0-100) with action-oriented severity.
• Decision-ready diagnosis text:

- urgent review, - monitor, - likely non-executable.

• Line-level evidence:

- dangerous function usage, - obfuscation/decode behavior, - decode depth, - YARA rule hits, - execution context.

Keys and integration strategy

• VirusTotal:

- embedded keys or --vt-keys-file.

• Abuse.ch remote YARA:

- embedded keys or --yara-keys-file.

• Wordfence:

- embedded keys or --wordfence-keys-file.

Initial Wordfence non-interactive setup:

wordfence configure -r -D

Incident-response operation model

• Run --strict --only-actionable for production first-pass triage.
• Run --audit during deep investigation windows.
• Export HTML for executive sharing and JSON/CSV for technical pipelines.
• Apply baseline/allowlist only after manual validation to avoid masking real threats.

Practical troubleshooting

# check runtime
python3 -V

# check dependencies
python3 -m pip list | grep -Ei 'yara|requests|wordfence'

# minimal test scan
python3 encfind.py -d /home/user/public_html/ --min-risk 50

Stack and tooling

• Python 3
• YARA
• VirusTotal API
• Wordfence CLI
• JSON/CSV/HTML exporters

Operational tags

• Python
• Malware Analysis
• Web Security
• YARA
• VirusTotal

Operational outcome

• Faster triage on large PHP codebases.
• Better evidence prioritization through score + reasons.
• Easier day-to-day adoption for hosting security operations.