search

manorit2001 / c3i-malware-analysis

Real time system changes monitoring solution ( Project done at c3i IITK )
1 stars 3 forks source link

[analysis] complete static analysis #42

Closed manorit2001 closed 3 years ago

manishkumarr1017 commented 3 years ago

https://database.clamav.net/main.cvd https://database.clamav.net/daily.cvd https://github.com/Yara-Rules/rules

manishkumarr1017 commented 3 years ago 
Failed to import '/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/lib/libyara.so'
PATH = /home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/bin:/home/user/.local/bin:/home/user/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/var/lib/snapd/snap/bin:/usr/lib/jvm/default/bin:/home/user/.fzf/bin;/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/lib
Traceback (most recent call last):
  File "/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/analysis.py", line 3, in <module>
    from detection.signature_based_detection import SignatureBasedDetection
  File "/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/detection/signature_based_detection.py", line 2, in <module>
    import yara
  File "/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/lib/python3.9/site-packages/yara/__init__.py", line 7, in <module>
    from yara.rules import compile
  File "/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/lib/python3.9/site-packages/yara/rules.py", line 17, in <module>
    from yara.libyara_wrapper import *
  File "/home/user/Projects/malware-analysis/c3i-malware-analysis/analysis/env/lib/python3.9/site-packages/yara/libyara_wrapper.py", line 315, in <module>
    libyaradll = cdll.LoadLibrary(library)
  File "/usr/lib/python3.9/ctypes/__init__.py", line 452, in LoadLibrary
    return self._dlltype(name)
  File "/usr/lib/python3.9/ctypes/__init__.py", line 374, in __init__
    self._handle = _dlopen(self._name, mode)
OSError: libpcre.so.3: cannot open shared object file: No such file or directory

Also, run black and isort on the files. Also update requirements.txt

This is because the libyara is not present in the desired location so you can find the libyara.so by using the find command(find / -name libyara.so) and copy to the destination location or in PATH