VirusTotal regex: always skip the first result (see solution) about tekdefense-automater

[parosterbergmedina]

This regex is also having negative effects for very short detection name, example md5 43270e8c58d428a17fd0b277483e44d8

Changing this to '},\s"(.{3,20})"....detected...true.{19,32}result....(.{8,40})....update' seems to do the trick.

[parosterbergmedina]

Virus names are getting longer and longer. Pushed the character limit up to 50, use case below.
MD5:9719ce372a59ff370fa5bb93d4ad85ca

Still getting issues with the detection for 'Bkav' though and I'm not sure why. Anyone? Bueler?

[ignacioj]

The problem is that the results for 'Bkav' are the first ones. This is part of the raw answer from VirusTotal:
........{"scans": {"Bkav": {"detected": true, "version": "1.3.0.8021", "result": "W32.HfsAdware.578C", "update": "20160519"}, "TotalDefense": {"detecte........
And the regex starts with: '},........'
I have changed the regex to:
<entry>\"([^"]{1,20})\"....detected...true.{19,32}result....([^"]{8,50})....update[^\}]*\}</entry>
So far it looks like it is working.

[1aN0rmus]

Thanks for reporting! If you want credit for the contribution, feel free to
submit a pull request and I will accept your update into the code.

On Sat, May 28, 2016 at 1:27 PM, ignacioj [email protected] wrote:

The problem is that the results for 'Bkav' are the first ones. This is
part of the raw answer from VirusTotal:
........{"scans": {"Bkav": {"detected": true, "version": "1.3.0.8021",
"result": "W32.HfsAdware.578C", "update": "20160519"}, "TotalDefense":
{"detecte........
And the regex starts with: '},........'
I have changed the regex to:

"([^"]{1,20})"....detected...true.{19,32}result....([^"]{8,50})....update[^}]*}
So far it looks like it is working.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
#33 (comment),
or mute the thread
https://github.com/notifications/unsubscribe/ACfUhjxo-113v9oDr5G1X76TmN3M9GyHks5qGHsGgaJpZM4IOP0p
.