Wrong identification of Python code

[kam193]

Describe the bug
As usual, there are a couple of Python code files that were not identified correctly :)

cc: @gdesmar

Password for all files: zippy. As usual, they can contact dangerous code.

The following files were identified as text/plain:

1. BitForger.py.zip
   • possible characteristics: import urllib.request, subprocess.run, urllib.request.urlretrieve
2. _deobfuscated_code_FINAL.py (kopia).zip
   • characteristic executor: exec(lzma.decompress(
3. init.py.zip
   • quite similar to the (1), but a little longer
4. init.py(1).zip
   • import urllib.parse, import aiohttp
5. init.py (kopia).zip
   • subprocess.Popen
6. tools.py.zip
   • similar to (2), exec(lzma.decompress(base64.b64decode

The following files were identified as code/ps1. Those are more complicated, as they do contain PowerShell commands, but they are Python scripts:

1. init.py.zip
2. uidesign.py.zip

The same story, but with code/batch identification:

3. 4a2353d4be195e06172985931534fe14dbe5746c452c7a27c1d4a5d51d516eb6.zip

To Reproduce
Steps to reproduce the behavior:

1. Upload and see the wrong file type

Expected behavior
Identification as code/python.

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information if pertinent):

• Assemblyline Version: 4.5.0.x - those files were collected for some time
• Browser: [e.g. chrome, safari]

Additional context
Add any other context about the problem here.

[kam193]

And a little different case - wrong identified JavaScript. Interestingly, the mime type was originally application/javascript, but the final one is unknown -> maybe even for untrusted mimes, it would be useful to fall back to them if there is nothing better?
9bc1e972b4c7e11256f817954f51c07963fd6f17161c0c2ce867f0c3ba4173d1.zip
3adf910188dc6f0df92eca9a835aac4b31e3232b57adf661c8cfef4992812ea2.zip

[kam193]

A new example - Python code identified as text, interesting as it's just a revshell: setup.py(4).zip