yararules problem loading

[MandiYang]

Output of scanning one file with clamav when using yararules:

LibClamAV Warning: load_oneyara: string is too short YARA.possible_exploit
LibClamAV Warning: load_oneyara: clamav cannot support 1 input strings, skipping YARA.possible_exploit
LibClamAV Error: yyerror(): /var/lib/clamav/maldoc_somerules.yar line 235 undefined identifier "uint32be"
LibClamAV Warning: cli_loadyara: failed to parse or load 1 yara rules from file /var/lib/clamav/maldoc_somerules.yar, successfully loaded 14 rules.
LibClamAV Error: yyerror(): /var/lib/clamav/Maldoc_CVE_2017_8759.yar line 17 undefined identifier "uint32be"
LibClamAV Error: yyerror(): /var/lib/clamav/Maldoc_CVE_2017_8759.yar line 86 undefined identifier "RTFFILE"
LibClamAV Warning: load_oneyara[verify]: wide modifier [w] is not supported for regex subsigs
LibClamAV Warning: load_oneyara: clamav cannot support 1 input strings, skipping YARA.CVE_2017_8759_SOAP_txt
LibClamAV Warning: cli_loadyara: failed to parse or load 3 yara rules from file /var/lib/clamav/Maldoc_CVE_2017_8759.yar, successfully loaded 4 rules.
LibClamAV Error: yyerror(): /var/lib/clamav/Maldoc_hancitor_dropper.yar line 20 undefined identifier "uint32be"
LibClamAV Warning: cli_loadyara: failed to parse or load 1 yara rules from file /var/lib/clamav/Maldoc_hancitor_dropper.yar, successfully loaded 0 rules.
LibClamAV Warning: cli_loadyara: empty database file
LibClamAV Error: yyerror(): /var/lib/clamav/Maldoc_APT10_MenuPass.yar line 27 undefined identifier "hash"
LibClamAV Warning: cli_loadyara: failed to parse or load 1 yara rules from file /var/lib/clamav/Maldoc_APT10_MenuPass.yar, successfully loaded 0 rules.
LibClamAV Warning: cli_loadyara: empty database file

Fix this bug plz!

[extremeshok]

OS, Version, Version of config and script

[MandiYang]

Ubuntu20.04, clamav-unofficial-sigs version 7.25 and config version v97

[perplexityjeff]

Is this even a bug with the script or is it something that is in the yara rules repo?

@MandiYang Could you maybe as well post your version of ClamAV? Just in case.

Related? #203

[MandiYang]

problem with yara rules repo, not the script but disable theese yara rules when setting database rating, then I close this issue. clamav version is 0.102.4

[perplexityjeff]

I suppose that the pull request I made disables the Yara rules that are causing issues from master.conf.

#387

[MandiYang]

Ok, I close this issue