search

Yara-Rules / rules

Repository of yara rules
GNU General Public License v2.0
4.14k stars 1k forks source link

Undefined identifier in malicious_document.yar #78

Closed msapiro closed 8 years ago

msapiro commented 8 years ago

Clamav reports:

LibClamAV Error: yyerror(): /var/lib/clamav/malicious_document.yar line 245 undefined identifier "uint32be"

jholgui commented 8 years ago

yara version?

http://yara.readthedocs.org/en/latest/writingrules.html

uint32be is a yara keyword.

msapiro commented 8 years ago

This is with Clamav 0.99.0.

Apparently this is an issue with the Clamav implementation of YARA. I now see their docs (sec 3.11 of https://github.com/vrtadmin/clamav-devel/blob/master/docs/signatures.pdf ) say

YARA modules are not yet supported by ClamAV. This includes the “import” keyword and any YARA module-specific keywords.

Sorry for the noise.