Yara rules not working in debian [closed]

Question

Yara rules are working on Windows 7 perfectly. I am able to scan and detect malicious commands in .exe malware files but when I run the same program in debian v8.6, it can't detect malicious commands in .exe. When I run the same rule against a .txt file it works.

I don't understand what the issue is.

Yara rule:

rule isThis_Suspicious
{
    strings:
        $a = "CHAN"
        $b = "JOIN"
        $c = "arun"
    condition:
        1 of them
}

Output on debian v8.6 :

root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -s rule2.txt test.txt
isThis_Suspicious test.txt
0x5:$c: arun
root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -s rule2.txt  srvcp.exe

yara with -n

root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -n rule2.txt test.txt
root@debian:/Thwart/yaraCmd/yara-3.7.1# yara -n rule2.txt srvcp.exe
isThis_Suspicious srvcp.exe

Why its not matching the rule in debian but the same rule is working on windows.

output on windows 7:

D:\yara>yara64.exe rule2.txt test.txt
isThis_Suspicious test.txt

D:\yara>yara64.exe rule2.txt srvcp.exe
isThis_Suspicious srvcp.exe

Answer 1

Yara should have the same behavior on all platforms. As was discovered in the comments, it's important to make sure the rules files and targets are the same on both systems (by comparing sizes, sha1sums, etc.). It's possible for file transfers/copies to get interrupted, leading to file corruption or truncation that results in incomplete YARA matches.