YARA v4.5 releases: The pattern matching swiss knife
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression that determine its logic. Let’s see an example:
The above rule is telling YARA that any file containing one of the three strings must be reported as silent_banker. This is just a simple example, more complex and powerful rules can be created by using wild-cards, case-insensitive strings, regular expressions, special operators and many other features that you’ll find explained in YARA’s documentation.
It is multi-platform, running on Windows, Linux, and Mac OS X, and can be used through its command-line interface or from your own Python scripts with the Yara-python extension.
If you plan to use YARA to scan compressed files (.zip, .tar, etc) you should take a look at yextend, a very helpful extension to YARA developed and open-sourced by Bayshore Networks.
Changelog v4.5
- Unreferenced strings are allowed if their identifier start with
_
(#1941) - New command-line option
--disable-console-logs
for disabling the output of the console module (#1915) - New command-line option
--strict-escape
that raises warnings on unknown escape sequences (#1880). - Improve performance by avoiding the execution of rule conditions that can’t match (#1927)
- Add callback message
CALLBACK_MSG_TOO_SLOW_SCANNING
for notifying about slow rules (#1921). - Expose function RVA in
pe.export_details
(#1882). - BUGFIX: Fix issues in the computation of
imphash
inpe
module (#1944). Credits to the NSHC ThreatRecon team!
BUGFIX: Fix multiple out-of-bound memory reads index
module (#1949, #1951). - BUGFIX: Fix memory alignment issues (#1930).
- BUGFIX: Some strings with the wide and ascii modifiers not matching as they should (#1933).
- BUGFIX: Some rules not matching when
--fast-scan
is used (4de3d57) - BUGFIX: Properly list memory regions while scanning processes in Mac OS. (#2033)
- BUGFIX: RFC5652 countersignatures are now correctly parsed in
pe
module (#2034) - BUGFIX: Fix potential DoS due to crashes in authenticode parser with malformed files (#2034). Credits to Bahaa Naamneh!
- BUGFIX: Fix SIGSEGV in
magic
module whenlibmagic
returns null pointer (3342aa0) - BUGFIX: Prevent infinite recursion while following symlinks (923368e)
Copyright (c) 2007-2016. The YARA Authors. All Rights Reserved.