1

I'm trying to start a filetype identification project for certain groups of files based on their file extension (.exe, .pdf, etc), using yara as the identification engine, but I've run into a problem.

When I try hunting for examples of these files all I get are websites that explain what the files are associated with.

I have a VT account, does anyone know whether it's possible to search based on filename extensions?

1

VT does allow searches based on filename, but it isn't always accurate as far as where the string is found in the filename/path. My workflow has turned into finding files based on the extention, writing goodware yara searches to find more examples of the filetype, and trying to tune to determine what the best signature with the most coverage is.

I feel like there should be a better way though, so I'm not going to accept this answer in case someone has a better solution or a repository more suited to the task.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.