CERT-Polska / malduck

:duck: Malduck is your ducky companion in malware analysis journeys
GNU General Public License v3.0
313 stars 32 forks source link

Retrieving XOR key from yara engine #117

Open Still34 opened 9 months ago

Still34 commented 9 months ago

Summary

Consider the following yara rule,

rule example {
    strings:
        $xor = "hello world!" xor
    condition:
        any of them
}

When using yara-python, one could fetch the found XOR key from the xor_key property from a StringMatchInstance object. This property does not appear to be passed to the yara wrapper in malduck yet?