plusvic/yara — pull request #197 by wxsBSD (2014-11-04 02:31:43+00:00)
Title: Address an import parsing problem.

I've got a binary here which pefile parses imports correctly but YARA
does not. It appears that when parsing the Import Directory if
OriginalFirstThunk is zero you can use FirstThunk.

I'm not sure this is legal to do, but there is a confirmed difference
in how pefile parses this sample and how YARA does it.