Yara rule not matching when it should about yara HOT 3 CLOSED

The problem here is that Payment_02_16_#522.one contains a newline character (0x0A) right after \x9c\x1d\x00\x1c, and the dot . in a regular expression matches everything except newline, except if you use the /s modifier in your regexp.

If you change your regexp to $1 = /\x9c\x1d\x00\x1c.{,200}\x63\x00\x6d\x00\x64/s it matches as expected, because the /s at the end means that the dot matches all bytes.

That's the standard behaviour in most regexp engines.

from yara.

@plusvic thank you for the response and sorry for the false report!

from yara.

No worries!

from yara.