{"id":9806,"date":"2026-01-12T04:04:12","date_gmt":"2026-01-12T04:04:12","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/12\/32616\/"},"modified":"2026-01-12T04:04:12","modified_gmt":"2026-01-12T04:04:12","slug":"32616","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/12\/32616\/","title":{"rendered":"YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th)"},"content":{"rendered":"<p>    YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th)<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p><a href=\"https:\/\/github.com\/VirusTotal\/yara-x\/releases\/tag\/v1.11.0\">YARA-X&#8217;s 1.11.0<\/a> release brings a new feature: hash function warnings.<\/p>\n<p>When you write a YARA rule to match a cryptographic hash (either the full file content or a part of it), what&#8217;s actually going on are string comparisons:<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20260111-120140.png?ssl=1\" style=\"width: 993px; height: 305px;\"><\/p>\n<p>Function hash.sha256 returns a string (the hexadecimal SHA256 hash it calculated) and that is compared to a literal string that is the hash you want to find.<\/p>\n<p>If you make a mistake in your literal string hash (for example: unintentionally add an extra space), then the match will fail.<\/p>\n<p>But YARA-X will now show a warning like this:<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\" src=\"https:\/\/i0.wp.com\/isc.sans.edu\/diaryimages\/images\/20260111-120202.png?ssl=1\" style=\"width: 993px; height: 279px;\"><\/p>\n<p>Another example is where you mixup hashes: you provide a SHA1 literal string hash, and it should be a SHA256.<\/p>\n<p>\u00a0<\/p>\n<p>Didier Stevens<br \/>\nSenior handler<br \/>\n<a href=\"http:\/\/blog.didierstevens.com\/\">blog.DidierStevens.com<\/a><\/p>\n<p> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><\/p>\n<p> \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/isc.sans.edu\/diary\/rss\/32616\">Go to isc.sans.edu<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>YARA-X 1.11.0 Release: Hash Function Warnings, (Sun, Jan 11th) YARA-X&#8217;s 1.11.0 release brings a new feature: hash function warnings. When you write a YARA rule to match a cryptographic hash (either the full file content or a part of it), what&#8217;s actually going on are string comparisons: Function hash.sha256 returns a string (the hexadecimal SHA256 [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-9806","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9806"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9806"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9806\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9806"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9806"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}