yara icon indicating copy to clipboard operation
yara copied to clipboard

hash.md5() missing in Python YARA 3.6.x

Open Neo23x0 opened this issue 6 years ago • 8 comments

I upgraded yara-python from 3.5.0 to 3.6.3 and noticed errors if conditions contain a hash.md5 statement.

invalid field name "md5"

In version 3.5.0, the pe.imphash wasn't available. I thought that both depend on the OpenSSL integration.

invalid field name "imphash"

Neo23x0 avatar Oct 11 '17 17:10 Neo23x0

for my case hash module is working well in python yara 3.6.3 on Ubuntu but not on windows (No module named hash -_-)

justNik101 avatar Oct 12 '17 21:10 justNik101

I'd like to add that a simple import "hash" leads to an error Unknown module "hash" with YARA Python 3.6.3.

Neo23x0 avatar Oct 16 '17 13:10 Neo23x0

Same here ( why is this case for windows ......)

justNik101 avatar Oct 16 '17 15:10 justNik101

Same issue

jane567 avatar Feb 19 '18 06:02 jane567

Any news about this issue?

garanews avatar Apr 05 '18 09:04 garanews

Same issue :/

Maxou56800 avatar Jun 21 '18 15:06 Maxou56800

In case anybody else is struggeling with this, make sure you have the openssl-dev package installed before installing yara-python. On Debian this is called libssl-dev. Uninstall / re-install yara-python and you should be good.

At least this did the trick for me.

sim0nx avatar May 20 '19 12:05 sim0nx

Are there any workarounds for this? libssl-dev is not available for macOS and occurs with openssl 1.0.2s

R34rvi3w avatar Jul 08 '19 16:07 R34rvi3w