{"id":10058,"date":"2021-06-15T16:12:13","date_gmt":"2021-06-15T14:12:13","guid":{"rendered":"https:\/\/www.nextron-systems.com\/?p=10058"},"modified":"2022-03-25T14:15:39","modified_gmt":"2022-03-25T13:15:39","slug":"use-yara-math-module-extension-in-thor-techpreview-and-thor-lite","status":"publish","type":"post","link":"https:\/\/www.nextron-systems.com\/2021\/06\/15\/use-yara-math-module-extension-in-thor-techpreview-and-thor-lite\/","title":{"rendered":"Use YARA math Module Extension in THOR TechPreview and THOR Lite"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_column type=”2_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_text _builder_version=”4.9.7″ _module_preset=”default”]<\/p>\n

Not long ago, we’ve created a pull request<\/a> for the official YARA repository on Github, that would introduce new functions in the `math` module to improve the flexibility in cases in which a sample is heavily scrambled or obfuscated. These cases require further statistical evaluations that go beyond the currently available “entropy”, “mean” or “deviation” functions.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/06\/Screenshot-2021-06-15-at-15.47.54.png” title_text=”Screenshot 2021-06-15 at 15.47.54″ _builder_version=”4.9.7″ _module_preset=”default”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_column type=”2_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_text _builder_version=”4.9.7″ _module_preset=”default”]<\/p>\n

The example on the right shows a heavily obfuscated PHP web shell, as used by a Chinese actor.\u00a0<\/p>\n

You immediately notice the high amount of “%” characters, but since each of them is preceded and followed by different characters, it’s difficult to find atoms that are long enough to maintain an acceptable performance \/ stability of that rule.\u00a0<\/p>\n

 <\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/06\/Screenshot-2021-06-15-at-15.40.23.png” title_text=”Screenshot 2021-06-15 at 15.40.23″ _builder_version=”4.9.7″ _module_preset=”default”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_column type=”2_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_text _builder_version=”4.9.7″ _module_preset=”default”]<\/p>\n

If you could, you would formulate a rule like this: “Detect files smaller 400 bytes, that begin with ‘<?’ and consist of at least 25 percent ‘%’ characters”.\u00a0<\/p>\n

Well, the new module extension allows you to do exactly that.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_image src=”https:\/\/www.nextron-systems.com\/wp-content\/uploads\/2021\/06\/Screenshot-2021-06-15-at-17.50.54.png” title_text=”Screenshot 2021-06-15 at 17.50.54″ _builder_version=”4.9.7″ _module_preset=”default” hover_enabled=”0″ sticky_enabled=”0″][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”2_5,3_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_column type=”2_5″ _builder_version=”4.9.7″ _module_preset=”default”][et_pb_text _builder_version=”4.9.7″ _module_preset=”default”]<\/p>\n

Read the documentation<\/a> provided with the pull request for details on all three new functions:<\/p>\n