diff --git a/libyara/modules/pe/pe.c b/libyara/modules/pe/pe.c index 2c9a5ed5..be488c03 100644 --- a/libyara/modules/pe/pe.c +++ b/libyara/modules/pe/pe.c @@ -2730,7 +2730,7 @@ define_function(imphash) // If extension is 'ocx', 'sys' or 'dll', chop it. - char* ext = strstr(dll->name, "."); + char* ext = strrchr(dll->name, '.'); if (ext && (strncasecmp(ext, ".ocx", 4) == 0 || strncasecmp(ext, ".sys", 4) == 0 || diff --git a/tests/BUILD.bazel b/tests/BUILD.bazel index bc158692..faabb5ba 100644 --- a/tests/BUILD.bazel +++ b/tests/BUILD.bazel @@ -119,6 +119,7 @@ cc_test( "data/ChipTune.efi", "data/c6f9709feccf42f2d9e22057182fe185f177fb9daaa2649b4669a24f2ee7e3ba_0h_410h", "data/ca21e1c32065352d352be6cde97f89c141d7737ea92434831f998080783d5386", + "data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345", "data/mtxex.dll", "data/mtxex_modified_rsrc_rva.dll", "data/pe_imports", diff --git a/tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 b/tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 new file mode 100644 index 00000000..76974fcb Binary files /dev/null and b/tests/data/e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345 differ diff --git a/tests/test-pe.c b/tests/test-pe.c index d2b9cf72..c46171e2 100644 --- a/tests/test-pe.c +++ b/tests/test-pe.c @@ -276,6 +276,15 @@ int main(int argc, char** argv) }", "tests/data/tiny_empty_import_name"); + assert_true_rule_file( + "import \"pe\" \ + rule test { \ + condition: \ + pe.imphash() == \"d49b7870cb53f29ec3f42b11cc8bea8b\" \ + }", + "tests/data/" + "e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345"); + #endif #if defined(HAVE_LIBCRYPTO)