I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores string hits that exist within the resource section. This would allow my signatures to correctly identify droppers from the malware that is dropped. I tried doing something like this:

        (pe.sections[0].characteristics & pe.SECTION_CNT_CODE) and $handshake 

to limit my condition to the .text section, but this is definitely not write. That is going to trigger only if the .text section is the first section and the $handshake string exists anywhere within the binary. what I'd like is a way to limit the $handshake to the .text section (or in any section that is not the resource section).

Is this even possible with YARA or is that getting a bit too complicated for YARA?

1 Answer 1


WXS on the Yara Google Groups was kind enough to post an answer to this question. He has several examples here: https://gist.github.com/wxsBSD/4d5d7677578f80cdf82a

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.