0% found this document useful (0 votes)
405 views4 pages

Clamav To Yara - Py

This Python script converts ClamAV antivirus signature files (.cvd or .cld) into YARA rules by parsing the ClamAV file line-by-line and handling ClamAV-specific regex patterns to transform the signatures into a valid YARA rule syntax. It supports options like specifying the input and output files, adding a search filter, and verbose output. Each ClamAV signature is parsed, sanitized, and added to a YARA rule along with associated conditions before being written to the output file.

Uploaded by

Ali Azan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
405 views4 pages

Clamav To Yara - Py

This Python script converts ClamAV antivirus signature files (.cvd or .cld) into YARA rules by parsing the ClamAV file line-by-line and handling ClamAV-specific regex patterns to transform the signatures into a valid YARA rule syntax. It supports options like specifying the input and output files, adding a search filter, and verbose output. Each ClamAV signature is parsed, sanitized, and added to a YARA rule along with associated conditions before being written to the output file.

Uploaded by

Ali Azan
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 4

#!

/usr/bin/env python
# encoding: utf-8
#
# Tested on Linux (Ubuntu), Windows XP/7, and Mac OS X
#
"""
clamav_to_yara.py

Created by Matthew Richard on 2010-03-12.


Copyright (c) 2010 __MyCompanyName__. All rights reserved.
"""

import sys
import os
import re
from optparse import OptionParser

def main():
parser = OptionParser()
parser.add_option("-f", "--file", action="store", dest="filename",
type="string", help="scanned FILENAME")
parser.add_option("-o", "--output-file", action="store", dest="outfile",
type="string", help="output filename")
parser.add_option("-v", "--verbose", action="store_true", default=False,
dest="verbose", help="verbose")
parser.add_option("-s", "--search", action="store", dest="search",
type="string", help="search filter", default="")

(opts, args) = parser.parse_args()

if opts.filename == None:
parser.print_help()
parser.error("You must supply a filename!")
if not os.path.isfile(opts.filename):
parser.error("%s does not exist" % opts.filename)

if opts.outfile == None:
parser.print_help()
parser.error("You must specify an output filename!")

yara_rule = """
rule %s
{
strings:
%s
condition:
%s
}

"""
rules = {}
output = ""
data = open(opts.filename, 'rb').readlines()

if (opts.filename.endswith(".cvd") or opts.filename.endswith(".cld")) and


data[0].find("ClamAV") == 0:
print "It seems you're passing a compressed database."
print "Try using sigtool -u to decompress first."
return
print "[+] Read %d lines from %s" % (len(data), opts.filename)

# ClamAV signatures are one per line


for line in data:
# signature format is
# name:sigtype:offset:signature
try:
vals = line.split(':')
if len(vals) < 4 or len(vals) > 6:
print "**ERROR reading ClamAV signature file**"
continue
name = vals[0]
sigtype = vals[1]
offset = vals[2]
signature = vals[3]
except:
print "**ERROR reading ClamAV signature file**"
continue
# if specified, only parse rules that match a search criteria
if opts.search in name:

# sanitize rule name for YARA compatability


# YARA does not allow non-alphanumeric chars besides _
rulename_regex = re.compile('(\W)')
rulename = rulename_regex.sub('_', name)

# and cannot start with a number


rulename_regex = re.compile('(^[0-9]{1,})')
rulename = rulename_regex.sub('', rulename)

# if the rule doesn't exist, create a dict entry


if rulename not in rules:
rules[rulename] = []

# handle the ClamAV style jumps


# {-n} is n or less bytes
jump_regex = re.compile('(\{-(\d+)\})')
signature = jump_regex.sub('{0-\g<2>}', signature)

# {n-} is n or more bytes


jump_regex = re.compile('(\{(\d+)-\})')
matches = jump_regex.findall(signature)

if matches:
for match in matches:
#print "\t\tfound %s" % (match[1])
start = int(match[1])
jump_regex = re.compile('(\{(%d)-\})' %
(start))
if (start < 256):
#print "\t\t\tfound short jump of
len %d" % (start)
signature =
jump_regex.sub('[0-\g<2>]', signature)
else:
#print "\t\t\tfound long jump,
replacing with '*'"
signature = jump_regex.sub('*',
signature)

# {n-m} is n to m bytes
# need to make sure it's not bigger than 255,
# and the high bound cannot exceed 255
# if it is we'll treat it like a '*'
jump_regex = re.compile('(\{(\d+)-(\d+)\})')
matches = jump_regex.findall(signature)

if matches:
for match in matches:
#print "\t\tfound %s - %s" % (match[1],
match[2])
start = int(match[1])
end = int(match[2])
jump_regex = re.compile('(\{(%d)-(%d)\})' %
(start, end))
if (end - start == 0):
if opts.verbose:
print "\t**Skip nothing,
impossible!**"
signature = jump_regex.sub('',
signature)
elif (end - start < 256) and (end < 256):
#print "\t\t\tfound short jump of
len %d" % (end - start)
signature =
jump_regex.sub('[\g<2>-\g<3>]', signature)
else:
#print "\t\t\tfound long jump,
replacing with '*'"
signature = jump_regex.sub('*',
signature)

# {n} bytes
# here we must also enforce the 255 byte maximum jump
# that YARA can handle
jump_regex = re.compile('(\{(\d+)\})')
matches = jump_regex.findall(signature)

if matches:
for match in matches:
#print "\t\tfound %s" % (match[1])
start = int(match[1])
jump_regex = re.compile('(\{(%d)\})' %
(start))
if start < 256:
#print "\t\t\tfound short jump of
len %d" % (start)
signature =
jump_regex.sub('[\g<2>]', signature)
else:
#print "\t\t\tfound long jump,
replacing with '*'"
signature = jump_regex.sub('*',
signature)

# translate the '*' operator into a pair of signatures


# with an 'and'
if '*' in signature:
for part in signature.split('*'):
if part[0] != '(':

rules[rulename].append(part.strip())
else:
if signature[0] != '(':
rules[rulename].append(signature.strip())

for rule in rules.keys():


detects = ''
conds = "\t"
x = 0
for detect in rules[rule]:
detects += "\t$a%d = { %s }\r\n" % (x, detect)
if x > 0:
conds += " and "
conds += "$a%d" % (x)
x += 1
if detects == '':
if opts.verbose:
print "\t**Found empty rule %s, skipping**"
% rule
continue
else:
output += yara_rule % (rule, detects, conds)

if len(output) > 0:
print "\r\n[+] Wrote %d rules to %s\r\n" % (len(rules),
opts.outfile)
fout = open(opts.outfile, 'wb')
fout.write(output)
fout.close()
else:
print "\r\n**Could not find any signatures to convert!!!**\r\n"

if __name__ == '__main__':
print "\n" + '#' * 75
print "\t" + "Malware Analyst's Cookbook - ClamAV to YARA Converter 0.0.1"
print "\n" + '#' * 75, "\n"

main()

You might also like