YARA Rule Hash Used by Nextron Systems

snippet_gen_yara_hash.py

import hashlib
import re

def calculate_rule_hash(rule):
    """
    Calculates a hash over the relevant YARA rule content (string contents, sorted condition)
    Requires a YARA rule object as generated by 'plyara': https://github.com/plyara/plyara
    :param rule: yara rule object
    :return hash: generated hash
    """
    hash_strings = []
    m = hashlib.md5()
    # Adding all string contents to the list
    if 'strings' in rule:
        for s in rule['strings']:
            if s['type'] == "byte":
                hash_strings.append(re.sub(r'[^a-fA-F\?0-9]+', '', s['value']))
            else:
                hash_strings.append(s['value'])
    # Adding the components of the condition to the list (except the variables)
    for e in rule['condition_terms']:
        if not e.startswith("$") and not e.startswith("#"):
            hash_strings.append(e)
    # Empty
    if len(hash_strings) == 0:
        return ""
    # Generate a hash from the sorted contents
    hash_strings.sort()
    m.update("".join(hash_strings).encode("ascii"))
    return m.hexdigest()