pdfalyzer 1.16.6__py3-none-any.whl → 1.16.8__py3-none-any.whl

CHANGELOG.md

@@ -1,5 +1,15 @@
 # NEXT RELEASE
 
+### 1.16.8
+* Even more PDF related YARA rules
+* Upgrade `anytree` to 2.13.0
+* Upgrade `yaralyzer` to 1.0.4
+
+### 1.16.7
+* Lots of new PDF related YARA rules
+* Upgrade `yaralyzer` to 1.0.3
+* Upgrade `pypdf` to 5.9.0
+
 ### 1.16.6
 * Add the creator hash to GIFTEDCROOK rule
 

pdfalyzer/detection/yaralyzer_helper.py

@@ -13,9 +13,11 @@ from pdfalyzer.config import PdfalyzerConfig
 YARA_RULES_DIR = files('pdfalyzer').joinpath('yara_rules')
 
 YARA_RULES_FILES = [
+    'didier_stevens.yara',
     'lprat.static_file_analysis.yara',
     'PDF.yara',
     'PDF_binary_stream.yara',
+    'pdf_malware.yara',
 ]
 
 
@@ -34,18 +36,20 @@ def _build_yaralyzer(scannable: Union[bytes, str], label: Optional[str] = None)
     with as_file(YARA_RULES_DIR.joinpath(YARA_RULES_FILES[0])) as yara0:
         with as_file(YARA_RULES_DIR.joinpath(YARA_RULES_FILES[1])) as yara1:
             with as_file(YARA_RULES_DIR.joinpath(YARA_RULES_FILES[2])) as yara2:
-                # If there is a custom yara_rules argument file use that instead of the files in the yara_rules/ dir
-                rules_paths = YaralyzerConfig.args.yara_rules_files or []
-
-                if not YaralyzerConfig.args.no_default_yara_rules:
-                    rules_paths += [str(y) for y in [yara0, yara1, yara2]]
-
-                try:
-                    return Yaralyzer.for_rules_files(rules_paths, scannable, label)
-                except ValueError as e:
-                    # TODO: use YARA_FILE_DOES_NOT_EXIST_ERROR_MSG variable
-                    if "it doesn't exist" in str(e):
-                        print(str(e))
-                        exit(1)
-                    else:
-                        raise e
+                with as_file(YARA_RULES_DIR.joinpath(YARA_RULES_FILES[3])) as yara3:
+                    with as_file(YARA_RULES_DIR.joinpath(YARA_RULES_FILES[4])) as yara4:
+                        # If there is a custom yara_rules argument file use that instead of the files in the yara_rules/ dir
+                        rules_paths = YaralyzerConfig.args.yara_rules_files or []
+
+                        if not YaralyzerConfig.args.no_default_yara_rules:
+                            rules_paths += [str(y) for y in [yara0, yara1, yara2, yara3, yara4]]
+
+                        try:
+                            return Yaralyzer.for_rules_files(rules_paths, scannable, label)
+                        except ValueError as e:
+                            # TODO: use YARA_FILE_DOES_NOT_EXIST_ERROR_MSG variable
+                            if "it doesn't exist" in str(e):
+                                print(str(e))
+                                exit(1)
+                            else:
+                                raise e