Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrong type with malice-plugins/yara #17

Closed
stanley101music opened this issue Feb 16, 2024 · 1 comment
Closed

Wrong type with malice-plugins/yara #17

stanley101music opened this issue Feb 16, 2024 · 1 comment

Comments

@stanley101music
Copy link

I've added https://github.com/malice-plugins/yara/tree/master to the configuration file.
The error appears in /main/rule_processors.py in function evaluate_yara_rule_score at line 517
where the meta_data is str not dict, and thus doesn't have items()

Here's the original yara rule that caused this error from https://github.com/malice-plugins/yara/blob/master/rules/rats.yar

rule Albertino
{
	meta:
		author = " Kevin Breen <[email protected]>"
		date = "2014/04"
		ref = "http://malwareconfig.com/stats/AAR"
		family = "albertino"
		tags = "rat, albertino"

	strings:
		$a = "Hashtable"
		$b = "get_IsDisposed"
		$c = "TripleDES"
		$d = "testmemory.FRMMain.resources"
		$e = "$this.Icon" wide
		$f = "{11111-22222-20001-00001}" wide
		$g = "@@@@@@@@@@@"

	condition:
		all of them
}

and the metadata of the rule that is sent as the input of evaluate_yara_rule_score is
'metadata': {'tags': 'ALBERTINO, RAT'}

Compared to other normal metadata, it seems that the type of the value of metadata should be a list of dictionaries,
while in this case, the type of the value is dictionary.

@Neo23x0
Copy link
Contributor

Neo23x0 commented Feb 17, 2024

This should fix the issues : #18

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants