sec51 / clamav-yara Goto Github PK

View Code? Open in Web Editor NEW

52.0 52.0 15.0 101.82 MB

Converts the Clamav Virus Database definitions to YARA rules [GOLANG]

License: ISC License

Go 81.55% Smarty 18.45%

clamav-yara's People

Contributors

Stargazers

Watchers

Forkers

pombredanne hainguyen007 chennqqi ralex1975 jrelo flyr4nk 5up3rc imuledx dmknght anomalroil derekhjray hecg119 webvul go-community int2ecall

clamav-yara's Issues

error: regular expression is too complex

Hello.
After parsing I have rules.
But I can't use them:

yara main_linux.yara /bin/ls
yara main_windows.yara prog.exe

I have error described below:

main_windows.yara(464362): warning: $signature in rule Win_Trojan_Lineage_85 is slowing down scanning
main_windows.yara(468844): warning: $signature in rule Win_Exploit_CVE_2006_4182_1 is slowing down scanning
main_windows.yara(804367): error: regular expression is too complex
main_windows.yara(804385): error: regular expression is too complex
main_windows.yara(821872): warning: $signature in rule Win_Trojan_SwizzorA_1 is slowing down scanning
main_windows.yara(821881): warning: $signature in rule Win_Trojan_Swizzor_607 is slowing down scanning
main_windows.yara(870184): warning: $signature in rule Win_Adware_Multiplug_3 is slowing down scanning
main_windows.yara(881315): error: invalid field name "virtual_address"

Certificate outdated

https://sec51.com/definitions/main.cvd certificate expired on January 2017, thus clamav-yara can't proceed

Parsing error - slice bounds out of range

2018/02/19 12:00:16 Downloading main definitions from https://sec51.com/definitions/main.cvd ...
2018/02/19 12:00:16 Download completed, proceeding with parsing.
2018/02/19 12:01:02 main.cvd parsing completed.
=========================
2018/02/19 12:01:02 Downloading daily definitions from https://sec51.com/definitions/daily.cvd ...
2018/02/19 12:01:02 Download completed, proceeding with parsing.
panic: runtime error: slice bounds out of range

goroutine 1 [running]:
main.extractFiles(0xc4201b2400, 0xb2, 0x200, 0x1, 0x0, 0x0, 0x0)
	/home/corey/git/clamav-yara/definitions.go:296 +0xb61
main.(*DefinitionsManager).DownloadDefinitions(0xc42005c480, 0xc42000e001, 0x0, 0x0)
	/home/corey/git/clamav-yara/definitions.go:237 +0x48b
main.downloadDefinitions(0xc42005c480)
	/home/corey/git/clamav-yara/main.go:34 +0x98
main.main()
	/home/corey/git/clamav-yara/main.go:19 +0x8e

The rule names are generated from ClamAV malware name.
In ClamAV definitions the same name appears multiple times.
We need to add an additional identifier to the Malware name.
This is visible when generating the rules from the main.cvd

Parse additional signatures

At the moment we are parsing only NDB signatures.
Add:

HDB signatures
HSB signatures

Both signatures are for file only. Basically they can detect static malware only.
The format is the following:

HashString:FileSize:MalwareName

The difference between the two is that HDB uses md5 whereas HSB uses sha1 and sha256 we need to distinguish based on the length of the hash.

In YARA we need to use the hash plugin and do something like this:

condition:
        hash.md5(0, filesize) == "md5_hash_obtained_from_clamav_signatures"

sec51 / clamav-yara Goto Github PK

clamav-yara's People

Contributors

Stargazers

Watchers

Forkers

clamav-yara's Issues

error: regular expression is too complex

Certificate outdated

Parsing error - slice bounds out of range

Duplicate rules names

Parse additional signatures

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent