import re

def findall(filename, text):
    with open(filename) as f:
        for line in f:
            if text in line:
                yield line
                
if __name__ == '__main__':
    record1 = 0
    record2 = 0
    record3 = 0
    content = 'log.txt'

    for search_result in findall(content, 'Rename'):
        if re.findall(r'ScapeGoat\\.*.docx',search_result):
            record1+=1
    print("number of docx renamed : %d" %record1)
    
    for search_result in findall(content, 'Modify'):
        if re.findall(r'ScapeGoat\\.*..*',search_result):
            record2+=1
    print("number of files modified : %d" %record2)
    
    for search_result in findall(content, 'Create'):
        list = search_result.split(':')
        for search_result in findall(content, 'Delete'):
            if re.findall(list[1].strip(),search_result):
                record3+=1
    print("number of files deleted : %d" %record3)

    if(record1 >3 and record2 >3 and record3 >= 1):
        print("malware detected --> HEUR:Trojan-Ransom.DocxEncrypt.Generic")
    else:
        print("No malware detected")






