Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

List of errors in Yara rule files #1

Open
MrCrumbs opened this issue Apr 1, 2019 · 0 comments
Open

List of errors in Yara rule files #1

MrCrumbs opened this issue Apr 1, 2019 · 0 comments

Comments

@MrCrumbs
Copy link

MrCrumbs commented Apr 1, 2019

Syntax errors:

APT34_PDB_path.yar: No rule name
jar_drops_9002.yar: Rule name illegal (starts with digit - "9002_DROPPER")
Emirates_Cred_Steal.yar: No identifier after colon ("rule EmiratesStatement : {")
crunchyroll.yar: Rule name illegal (has slashes - "rule CrunchyRoll_11/4/17{")
DMALocker4.0.yara: Rule name illegal (has period - "rule DMALocker4.0")
Satana_Ransomware.yara: No rule name before colon ("rule: Satana_Ransomware")
Vbs-Obfuscated.yara: Rule name illegal (has period - "rule Malware.Gen.Vbs.Obfuscated")
Destructive_Target_Cleaning_Tool_4.yar: Colon but no tag ("rule Destructive_Target_Cleaning_Tool_4:{")
blackhole2_htm4.yar: No rule name
apt_ProjectSauron_MyTrampoline.yar: "rrule" instead of "rule"
APT1_payloads.yar: "rivate rule" instead of "private rule"
kivars_service.yar: String name "SHA-256" illegal (no hyphens allowed in variable names)
madness.yar: Missing "meta:" before meta information

Logical errors:

billgates.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
ggupdate.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
libgcc.yara - uses "IsElfFile" without adding 'include "IsElfFile.yara"'
command_shell.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
conbot.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
emotet.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
ggupdate.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
hawkeye.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
nkh.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
scrtest.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
sqldb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
viewweb.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
virtualbox_detection.yara - uses "IsPeFile" without adding 'include "IsPeFile.yara"'
APT1_aspnetreport.yar - uses "APT1_payloads" without adding 'include "alienvault_index.yara"'
Karagany.yar - uses "isPE" without adding 'include "IsPE.yar"'

@MrCrumbs MrCrumbs changed the title List of Syntax errors in Yara rule files List of errors in Yara rule files Apr 1, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant