Dear Kris, I've had the same issue. In the last two years, I was regularly writing YARA sigs in ClamAV and finding that it behaves in strange ways... Especially the regex integration.
I specifically remember that counting regex wasn't possible and that I had to
write those sigs either in strings or HEX.
After too many timeouts and strange stuff, I decided to rewrite all of the sigs
I had written to LDB. It's not easy to read, less fun to write... but damn it's
much more reliable and fast.
Here's what your sig could look like:
KGD.LDB.JS.SENDEMAIL;Engine:81-255,Target:3;0>3;3c73637269707420747970653d22746578742f6a617661736372697074223e66756e6374696f6e73656e64656d61696c{0-1}28297b
I took the liberty to define Target:3 (HTML). You might need to change that.
Adding more criteria might be good too.
Best,
Laurent
PS: This YARA might technically work, but might cost you lots of CPU:
$a3 = /(<script type="text\/javascript">functionsendemail.?\(\)\{.*){3}/
signature.asc
Description: OpenPGP digital signature
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
