fireeye-red-team-countermeasure-scanner icon indicating copy to clipboard operation
fireeye-red-team-countermeasure-scanner copied to clipboard

YARA unable to run due to missing Visual C++ Redistributable

Open BlueToast opened this issue 4 years ago • 2 comments

I have received this error message upon running build23.ps1:

ERROR: YARA was unable to run on this device. The Visual C++ Redistributable is required in order to use YARA.

I have the latest versions of both the 32-bit and 64-bit of the following runtimes installed:

  • Microsoft Visual C++ 2008 Redistributable 9.0.30729.6161 [END OF LIFE]
  • Microsoft Visual C++ 2010 Redistributable 10.0.40219
  • Microsoft Visual C++ 2012 Redistributable 11.0.61030
  • Microsoft Visual C++ 2013 Redistributable 12.0.30501, 12.0.40660, 12.0.40664
  • Microsoft Visual C++ 2015-2019 Redistributable 14.27.29016

It is greatly appreciated to have this scanner tool available, but it is somewhat concerning that the script errors out on a "missing distributable" error message despite all supported runtime redistributables being installed. Additionally, the README of this release does not specify what runtime (year) and version needs to be installed.

BlueToast avatar Jan 04 '21 20:01 BlueToast

Hi; Take a look here. Their documentation isn't great but it suggests that the Visual C++ redistributable 2010 is required. Remember also that you need both the x86 and x64 builds installed if you are on a 64-bit system. If you continue to see issues I think you may have more luck asking VirusTotal. Try executing the yara.exe binary directly on your device and seeing if it gives you an error that makes more sense than our best guess within the script.

Datto-StanLee avatar Feb 25 '21 09:02 Datto-StanLee

Had a server with the same error, installed the vcpp redist one by one testing until I found the one that allowed the script to run. In the end it was the 2015-2022 x64 version that did the trick: https://docs.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170#visual-studio-2015-2017-2019-and-2022

compunutter avatar Dec 15 '21 09:12 compunutter