update overlapping string test

mandiant · Jan 11, 2023 · dcf5a0f · dcf5a0f
1 parent 3e83a66
commit dcf5a0f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/tests/fixtures.py b/tests/fixtures.py
@@ -630,7 +630,7 @@ def parametrize(params, values, **kwargs):
         ("mimikatz", "function=0x40105D", capa.features.common.String("nope"), False),
         ("773290...", "function=0x140001140", capa.features.common.String(r"%s:\\OfficePackagesForWDAG"), True),
         # overlapping string, see #1271
-        ("294b8d...", "function=0x404970,bb=0x404970,insn=0x40499F", capa.features.common.String("\r\n"), True),
+        ("294b8d...", "function=0x404970,bb=0x404970,insn=0x40499F", capa.features.common.String("\r\n\x00:ht"), False),
         # insn/regex
         ("pma16-01", "function=0x4021B0", capa.features.common.Regex("HTTP/1.0"), True),
         ("pma16-01", "function=0x402F40", capa.features.common.Regex("www.practicalmalwareanalysis.com"), True),