Closed dre closed 6 years ago
If you perform this run:
./run_yextend -r test_rulesets/pdf_multiple_embed.yara -t test_files/pdf_with_multiple_embedded.pdf.tar.gz -j
you will get JSON output that for instance contains:
... { "child_file_name": "squld", "file_signature_MD5": "368c8cbc67d3ce1ff7d2735cfe84f670", "file_size": 1135000, "parent_file_name": "test_files/pdf_with_multiple_embedded.pdf.tar", "scan_type": "Yara Scan (ELF Executable)", "yara_matches_found": true, "yara_rule_id": "FILE_SIGS" } ...
The ruleset at hand contains meta data that needs to show up in that JSON output. If you look at the ruleset you will see:
... rule FILE_SIGS {
meta: description = "Known malware signature"
...
So the expected output would be something like:
... { "child_file_name": "squld", "file_signature_MD5": "368c8cbc67d3ce1ff7d2735cfe84f670", "file_size": 1135000, "parent_file_name": "test_files/pdf_with_multiple_embedded.pdf.tar", "scan_type": "Yara Scan (ELF Executable)", "yara_matches_found": true, "yara_rule_id": "FILE_SIGS", "description": "Known malware signature" } ...
If you perform this run:
./run_yextend -r test_rulesets/pdf_multiple_embed.yara -t test_files/pdf_with_multiple_embedded.pdf.tar.gz -j
you will get JSON output that for instance contains:
... { "child_file_name": "squld", "file_signature_MD5": "368c8cbc67d3ce1ff7d2735cfe84f670", "file_size": 1135000, "parent_file_name": "test_files/pdf_with_multiple_embedded.pdf.tar", "scan_type": "Yara Scan (ELF Executable)", "yara_matches_found": true, "yara_rule_id": "FILE_SIGS" } ...
The ruleset at hand contains meta data that needs to show up in that JSON output. If you look at the ruleset you will see:
... rule FILE_SIGS {
...
So the expected output would be something like:
... { "child_file_name": "squld", "file_signature_MD5": "368c8cbc67d3ce1ff7d2735cfe84f670", "file_size": 1135000, "parent_file_name": "test_files/pdf_with_multiple_embedded.pdf.tar", "scan_type": "Yara Scan (ELF Executable)", "yara_matches_found": true, "yara_rule_id": "FILE_SIGS", "description": "Known malware signature" } ...