You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I've added https://github.com/malice-plugins/yara/tree/master to the configuration file.
The error appears in /main/rule_processors.py in function evaluate_yara_rule_score at line 517
where the meta_data is str not dict, and thus doesn't have items()
rule Albertino
{
meta:
author = " Kevin Breen <[email protected]>"
date = "2014/04"
ref = "http://malwareconfig.com/stats/AAR"
family = "albertino"
tags = "rat, albertino"
strings:
$a = "Hashtable"
$b = "get_IsDisposed"
$c = "TripleDES"
$d = "testmemory.FRMMain.resources"
$e = "$this.Icon" wide
$f = "{11111-22222-20001-00001}" wide
$g = "@@@@@@@@@@@"
condition:
all of them
}
and the metadata of the rule that is sent as the input of evaluate_yara_rule_score is 'metadata': {'tags': 'ALBERTINO, RAT'}
Compared to other normal metadata, it seems that the type of the value of metadata should be a list of dictionaries,
while in this case, the type of the value is dictionary.
The text was updated successfully, but these errors were encountered:
I've added https://github.com/malice-plugins/yara/tree/master to the configuration file.
The error appears in
/main/rule_processors.py
in functionevaluate_yara_rule_score
atline 517
where the
meta_data
isstr
notdict
, and thus doesn't haveitems()
Here's the original yara rule that caused this error from https://github.com/malice-plugins/yara/blob/master/rules/rats.yar
and the
metadata
of the rule that is sent as the input ofevaluate_yara_rule_score
is'metadata': {'tags': 'ALBERTINO, RAT'}
Compared to other normal metadata, it seems that the type of the value of
metadata
should be a list of dictionaries,while in this case, the type of the value is dictionary.
The text was updated successfully, but these errors were encountered: