Open ryanohoro opened 1 year ago
Good catch @ryanohoro.
I wonder if we can import pe
into the taste.yara
file using the pe module and add in and not pe
(and not pe.is_pe
)?
Not entirely sure what the criteria are for pe
matching is for that module, so it may not work.
Describe the bug
When analyzing 7za.exe with Strelka, the
cab_file
flavor is applied, leading to it being processed by ScanLibarchive erroneously.c136b1467d669a725478a6110ebaaab3cb88a3d389dfa688e06173c066b76fcf 7za.exe
Because
cab_file
checks for both aMSCF
magic at the top, but also anywhere in a PE file, Windows-based compression utilities are likely to match. I expect that the second condition is an attempt to match self-extracting archives. ScanLibarchive can extract some self-extracting CAB files.Environment details
Steps to reproduce
cab_file
andScanLibarchive
in the output event.Expected behavior
Sample file should match only
mz_file
/application/x-dosexec
flavors.Screenshots
Release
Additional context