Questions tagged [yara]
The yara tag has no usage guidance.
6
questions
3
votes
0
answers
38
views
Cant find the string "AutoOpen" in a macro enabled Word document
So, I was testing a Yara rule which goes like this:
rule macro_auto_run
{
meta:
description = "Document with macro that auto runs"
strings:
$s1 = "...
- 319
1
vote
0
answers
33
views
Yara Rules 4.3 Warnings
$hex = {CC CC CC CC CC CC CC CC}
Warning : "$hex" may slow down scanning
Do anyone know how to remove this warning
- 31
2
votes
1
answer
184
views
Code based Yara rule
I have to write a Yara rules for malwares that is based on assember code. Suppose I have an unpacked malware sample. To avoid false positives, the selected code must be unique. Can anyone tell me ...
- 21
1
vote
1
answer
3k
views
Detecting cracked Themida packed malware
I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples.
As alluring as it is to suggest just blacklisting all Themida ...
- 173
5
votes
3
answers
838
views
Is there any websites to get malware files using YARA rules?
I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?
Note: I know some websites to get android malware samples using YARA.
But, I need Windows ...
- 121
0
votes
1
answer
379
views
How do I make a YARA signature that does NOT look in the resource section?
I'm trying to use YARA to sort out a variety of files into families. Some malware drops other malware from images within their resource images. What I'd like to do is write a signature that ignores ...
- 143