YARA v4.3.0-rc1 –skip-larger, (Sat, Jan 7th)

Campagnolo 1968 Tool Kit Wooden Box
Campagnolo 1968 Tool Kit Wooden Box

YARA release candidate 1 for version 4.3.0 brings a Windows fix for the –skip-larger option.

IIRC, the –skip-larger option was introduced about a year ago, and allows one to specify a filesize to skip files. Files larger than the given size would no be scanned during a directory scan.

Unfortunately, this feature was not implemented in the Windows version of YARA, but now it is.

Didier Stevens
Senior handler
Microsoft MVP

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Reposted from SANS. View original.

Alex Post