configuration.yaml

yara:
    path: "yara-signatures/"              # yara rules absolute or relative folder (files have to end wih *.yar) 
    rulesRC4Key: ""                       # yara rules can be ciphered with rc4 
yarascan:
    infinitescan: true                    # loop scan infinitely
    memory: true                          # scan process memory
    registry: true                        # scan windows registry
    startmenu: true                       # scan users start menu lnk
    taskscheduler: true                   # scan windows task scheduler
    userfilesystem: true                  # scan users %USERPROFILE% folder
    systemdrive: true                     # scan %SYSTEMDRIVE% folder
    absolutePaths: []                     # list custom directory scan
    absolutePathsRecursive: true          # recurse inside custom directories
response:
    dumpDirectory: ""                     # dump every processes memory for further analysis
    quarantineDirectory: ""               # when a file match a rule, dump its memory and executable to the following directory 
    quarantineRC4Key: "irma"              # key used to RC4 cipher memory dump and quarantined files 
    kill: false                           # try to kill a process whether it match a yara rule 
network:
    capture: false                        # capture network trafic (irma will run infinitely)
    bpffilter: ~                          # filter capture using Berkley Packet Filter 
    pcapfile: "capture.pcap"              # capture file path 
output:
    notifications: true                   # use Windows 10 notification panel when processes memory or files trigger a yara rule match 
    verbose: true                         # verbose console output (yara match does not need this option)
sfx:
    autoexec: true                        # auto execute irma after unzipping
    silentmode: true                      # prompt user to let him choose where to extract irma
    extractDirectory: "%temp%"            # default zip extract directory
    logfile: "irma.log"                   # output irma log to the following filepath
others:
    fakeProcesses: false                  # spawn and execute fake analysis process to mislead malware and make it stop if anti-debug is analysed
advancedparameters:
    maxScanFilesize: 1024                 # max file size scan (default: 1024Mb)
    cleanMemoryIfFileGreaterThanSize: 512 # force irma clean its memory when using lot of memory (default: after >512Mb file size scan)
    extensions:                    
        - ".txt" 
        - ".csv" 
        - ".htm" 
        - ".html" 
        - ".flv" 
        - ".f4v" 
        - ".avi" 
        - ".3gp" 
        - ".3g2" 
        - ".3gp2" 
        - ".3p2" 
        - ".divx" 
        - ".mp4" 
        - ".mkv" 
        - ".mov" 
        - ".qt" 
        - ".asf" 
        - ".wmv" 
        - ".rm" 
        - ".rmvb" 
        - ".vob" 
        - ".dat" 
        - ".mpg" 
        - ".mpeg" 
        - ".bik" 
        - ".fcs" 
        - ".mp3" 
        - ".mpeg3" 
        - ".flac" 
        - ".ape" 
        - ".ogg" 
        - ".aac" 
        - ".m4a" 
        - ".wma" 
        - ".ac3" 
        - ".wav" 
        - ".mka" 
        - ".rm" 
        - ".ra" 
        - ".ravb" 
        - ".mid" 
        - ".midi" 
        - ".cda" 
        - ".jpg" 
        - ".jpe" 
        - ".jpeg" 
        - ".jff" 
        - ".gif" 
        - ".png" 
        - ".bmp" 
        - ".tif" 
        - ".tiff" 
        - ".emf" 
        - ".wmf" 
        - ".eps" 
        - ".psd" 
        - ".cdr" 
        - ".swf" 
        - ".exe" 
        - ".lnk" 
        - ".dll" 
        - ".ps1" 
        - ".scr" 
        - ".ocx" 
        - ".com" 
        - ".sys" 
        - ".class" 
        - ".o" 
        - ".so" 
        - ".elf" 
        - ".prx" 
        - ".vb" 
        - ".vbs" 
        - ".js" 
        - ".bat" 
        - ".cmd" 
        - ".msi" 
        - ".msp" 
        - ".deb" 
        - ".rpm" 
        - ".sh" 
        - ".pl" 
        - ".dylib" 
        - ".doc" 
        - ".dot" 
        - ".docx" 
        - ".dotx" 
        - ".docm" 
        - ".dotm" 
        - ".xsl" 
        - ".xls" 
        - ".xlsx" 
        - ".xltx" 
        - ".xlsm" 
        - ".xltm" 
        - ".xlam" 
        - ".xlsb" 
        - ".ppt" 
        - ".pot" 
        - ".pps" 
        - ".pptx" 
        - ".potx" 
        - ".pptm" 
        - ".potm" 
        - ".ppsx" 
        - ".ppsm" 
        - ".rtf" 
        - ".pdf" 
        - ".msg" 
        - ".eml" 
        - ".vsd" 
        - ".vss" 
        - ".vst" 
        - ".vdx" 
        - ".vsx" 
        - ".vtx" 
        - ".xps" 
        - ".oxps" 
        - ".one" 
        - ".onepkg" 
        - ".xsn" 
        - ".odt" 
        - ".ods" 
        - ".odp" 
        - ".sxw" 
        - ".pub" 
        - ".mdb" 
        - ".accdb" 
        - ".accde" 
        - ".accdr" 
        - ".accdc" 
        - ".chm" 
        - ".mht" 
        - ".zip" 
        - ".tar"
        - ".7z" 
        - ".7-z" 
        - ".rar" 
        - ".iso" 
        - ".cab" 
        - ".jar" 
        - ".arj" 
        - ".dmg" 
        - ".smi" 
        - ".img" 
        - ".xar"