POST /analysis/yara/data

{
  "test_data": "string (base64-encoded)",
  "operation": "string (run_rule|run_community_rules)",
  "rule": "string (base64-encoded, conditional)"
}

{
  "results": [
    {
      "Table": {
        "title": "string",
        "data": [["array", "of", "strings"]],
        "category": "Yara"
      }
    },
    {
      "Metadata": {
        "title": "string", 
        "data": {
          "warnings": "string with compiler warnings",
          "custom_rule": "string with rule content"
        },
        "category": "Yara"
      }
    },
    {
      "Error": {
        "message": "string"
      }
    }
  ]
}

{
  "results": [
    {
      "Table": {
        "title": "Yara Community Rules",
        "data": [
          ["File", "Rule", "Description", "Author", "Tags"],
          ["Custom Data", "APT_Equation_Malware", "Detects Equation Group malware", "Florian Roth", "apt,equation,malware"],
          ["Custom Data", "Trojan_Generic", "Generic trojan detection rule", "Security Team", "trojan,malware"]
        ],
        "category": "Yara"
      }
    }
  ]
}

{
  "results": [
    {
      "Table": {
        "title": "Yara Analysis Results",
        "data": [
          ["File", "Rule"],
          ["Custom Data", "SuspiciousExecutable"]
        ],
        "category": "Yara"
      }
    },
    {
      "Metadata": {
        "title": "Rule metadata",
        "data": {
          "warnings": "warning[text_as_hex]: hex pattern could be written as text literal\n  --> line:12:9\n   |\n12 |         $hex_pattern = { 4D 5A }\n   |         ----------------------\n   |         |\n   |         this pattern can be written as a text literal\n   |         help: replace with \"MZ\"\n   |",
          "custom_rule": "rule SuspiciousExecutable\n{\n    meta:\n        description = \"Detects suspicious executable patterns\"\n        author = \"Cursed Tools\"\n        date = \"2024-01-01\"\n        \n    strings:\n        $suspicious_string1 = \"malware\" nocase\n        $suspicious_string2 = \"backdoor\" nocase\n        $api_call = \"CreateRemoteThread\"\n        $hex_pattern = { 4D 5A 90 00 }\n        \n    condition:\n        $hex_pattern at 0 and \n        any of ($suspicious_string*, $api_call)\n}"
        },
        "category": "Yara"
      }
    }
  ]
}

{
  "results": [
    {
      "Error": {
        "message": "The file was either corrupted or exceeded the maximum permitted size"
      }
    }
  ]
}

{
  "results": [
    {
      "message": "No matches found for the provided test data"
    }
  ]
}

Invalid test data format

Unauthorized

Rule is required

curl -X POST https://api.cursed.tools/analysis/yara/data \
  -H "Content-Type: application/json" \
  -H "X-Cursed-Api-Token: your_api_token" \
  -d '{
    "test_data": "TVoQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "operation": "run_rule",
    "rule": "cnVsZSBTdXNwaWNpb3VzRXhlY3V0YWJsZQp7CiAgICBtZXRhOgogICAgICAgIGRlc2NyaXB0aW9uID0gIkRldGVjdHMgc3VzcGljaW91cyBleGVjdXRhYmxlIHBhdHRlcm5zIgogICAgICAgIGF1dGhvcgkgPSAiQ3Vyc2VkIFRvb2xzIgogICAgICAgIGRhdGUgPSAiMjAyNS0wMS0wMSIKICAgICAgICAKICAgIHN0cmluZ3M6CiAgICAgICAgJHN1c3BpY2lvdXNfc3RyaW5nMSA9ICJtYWx3YXJlIiBub2Nhc2UKICAgICAgICAkc3VzcGljaW91c19zdHJpbmcyID0gImJhY2tkb29yIiBub2Nhc2UKICAgICAgICAkYXBpX2NhbGwgPSAiQ3JlYXRlUmVtb3RlVGhyZWFkIgogICAgICAgICRoZXhfcGF0dGVybiA9IHsgNEQgNUEgOTAgMDAgfQogICAgICAgICAgICAKICAgIGNvbmRpdGlvbjoKICAgICAgICAkaGV4X3BhdHRlcm4gYXQgMCBhbmQgCiAgICAgICAgYW55IG9mICgkc3VzcGljaW91c19zdHJpbmcqLCAkYXBpX2NhbGwpCn0="
  }'

curl -X POST https://api.cursed.tools/analysis/yara/data \
  -H "Content-Type: application/json" \
  -H "X-Cursed-Api-Token: your_api_token" \
  -d '{
    "test_data": "TVoQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
    "operation": "run_community_rules"
  }'

MZ\x90\x00This is a sample file content that might contain malware signatures.
The file includes suspicious API calls like CreateRemoteThread and other indicators.
This text is used for testing Yara rules against various patterns and signatures.

Some hex patterns might be present: 4D5A9000
And some strings that could trigger rules: malware, backdoor, virus, trojan

This is sample text content for analysis.
It may contain suspicious strings like:
- Registry modifications
- Network connections  
- File system operations
- Process injection techniques

API calls: CreateProcess, WriteProcessMemory, VirtualAllocEx
File paths: C:\Windows\System32\malware.exe

4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000

{
  "results": [
    {
      "Table": {
        "title": "Yara Community Rules Analysis",
        "data": [
          ["Rule", "Description", "Author", "Tags", "Severity"],
          ["apt_malware_family", "APT malware family detection", "@MalwareResearcher", "apt, malware, trojan", "high"],
          ["suspicious_api_calls", "Detects suspicious API call patterns", "@SecurityTeam", "api, injection, persistence", "medium"]
        ],
        "category": "Yara"
      }
    }
  ]
}

{
  "Metadata": {
    "title": "Rule metadata",
    "data": {
      "warnings": "warning[text_as_hex]: hex pattern could be written as text literal\n  --> line:12:9\n   |\n12 |         $hex_pattern = { 4D 5A }\n   |         ----------------------\n   |         |\n   |         this pattern can be written as a text literal\n   |         help: replace with \"MZ\"\n   |"
    },
    "category": "Yara"
  }
}