I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores string hits that exist within the resource section. This would allow my signatures to correctly identify droppers from the malware that is dropped. I tried doing something like this:
(pe.sections.characteristics & pe.SECTION_CNT_CODE) and $handshake
to limit my condition to the .text section, but this is definitely not write. That is going to trigger only if the .text section is the first section and the $handshake string exists anywhere within the binary. what I'd like is a way to limit the $handshake to the .text section (or in any section that is not the resource section).
Is this even possible with YARA or is that getting a bit too complicated for YARA?