yara.Error: could not map file into memory about binaryalert HOT 3 CLOSED

I've confirmed that this error can happen even with the max Lambda memory allocation (1.5 GB) and with any size input file. Perhaps the number / size of the YARA rules are to blame?

from binaryalert.

I think I've tracked it down: a recent commit to Neo23x0/signature-base adds a new rule which includes a pe.imphash condition.

The YARA rules successfully compile and load in Lambda, but they fail with the memory mapping error when matching against most Windows binaries. My best guess is that this fails because of #30 (hash module not yet supported in BinaryAlert)

So the solution for now is to disable all rules which use pe.imphash. I will add a check to enforce this with unit tests since it is so hard to debug.

from binaryalert.

An easy way to disable the relevant rules files is to rename rules_file.yar to rules_file.yar.DISABLED. BinaryAlert only includes files ending in .yar or .yara, so these files will be excluded from the next deploy.

from binaryalert.