Skip to content

Instantly share code, notes, and snippets.

Last active Feb 6, 2021
What would you like to do?
YARA Rule Hash Generator
import hashlib
import re
import plyara
def calculate_rule_hash(rule):
Calculates a hash over the relevant YARA rule content (string contents, sorted condition)
Requires a YARA rule object as generated by 'plyara':
:param rule: yara rule object
:return hash: generated hash
hash_strings = []
m = hashlib.md5()
# Adding all string contents to the list
if 'strings' in rule:
for s in rule['strings']:
if s['type'] == "byte":
hash_strings.append(re.sub(r'[^a-fA-F\?0-9]+', '', s['value']))
# Adding the components of the condition to the list (except the variables)
for e in rule['condition_terms']:
if not e.startswith("$"):
# Generate a hash from the sorted contents
return m.hexdigest()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment