A
A
Alistair O2018-09-14 10:13:36
Malware
Alistair O, 2018-09-14 10:13:36

How to use hash function in yara64.exe?

Hello,
the task is to do a hash search,
according to the link https://cyberdefenses.com/yara-hashing-magic/

import "hash" 

rule REALNOTEPAD {

    meta:
        description = "REAL NOTEPAD"

   

    condition:
        
        filesize < 3KB and
        hash.md5(0, filesize) == "698D51A19D8A121CE581499D7B701668"     
}

query yara64.exe -r md5_match.yara c:\Users\user1\Downloads finds nothing

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question