yara
yara copied to clipboard
Doesn't work with Yara-Rules?
Hello,
I can't get it to work at all. I have the following rule (from Yara-Rules):
rule suspicious_version : PDF raw
{
meta:
author = "Glenn Edwards (@hiddenillusion)"
version = "0.1"
weight = 3
strings:
$magic = { 25 50 44 46 }
$ver = /%PDF-1.\d{1}/
condition:
$magic in (0..1024) and not $ver
}
If I scan an infected PDF with this, I get nothing:
% yara clamav-yara-rules/suspicious-version.pdf.yara samples/vir.pdf ; echo $?
0
However, If I do the same with ClamAV, I get:
% clamscan -d clamav-yara-rules/suspicious-version.pdf.yara samples/vir.pdf
samples/vir.pdf: YARA.suspicious_version.UNOFFICIAL FOUND
----------- SCAN SUMMARY -----------
Known viruses: 1
Engine version: 0.99.4
Scanned directories: 0
Scanned files: 1
Infected files: 1
Data scanned: 0.00 MB
Data read: 0.00 MB (ratio 0.00:1)
Time: 0.038 sec (0 m 0 s)
I am using latest yara (version 3.8.1). I also tried the 3.7 branch, just in case current master is instable, to no avail - same result. OS is FreeBSD 10.3.
What am I doing wrong?
I don't know what you're doing wrong but when I took your rules file and ran it here using Yara 3.9 it worked fine. Perhaps your PDF files have a $ver which matches your regex?
If you're still troubled by this (I know your OP was a long time ago) please let me have a sample file to scan.