diff --git a/file/malware/hash/blackenergy-driver-amdide-hash.yaml b/file/malware/hash/blackenergy-driver-amdide-hash.yaml
index a2be5b70fe..d97717f7c3 100644
--- a/file/malware/hash/blackenergy-driver-amdide-hash.yaml
+++ b/file/malware/hash/blackenergy-driver-amdide-hash.yaml
@@ -7,7 +7,7 @@ info:
     Detects the AMDIDE driver from BlackEnergy malware
   reference:
     - http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/
-  tag: malware,blackenergy
+  tags: malware,blackenergy
 
 file:
   - extensions:
diff --git a/file/malware/hash/naikon-apt-malware-hash.yaml b/file/malware/hash/naikon-apt-malware-hash.yaml
index 1c2f5697c5..dc1a050adc 100644
--- a/file/malware/hash/naikon-apt-malware-hash.yaml
+++ b/file/malware/hash/naikon-apt-malware-hash.yaml
@@ -5,7 +5,7 @@ info:
   severity: info
   reference:
     - https://goo.gl/7vHyvh
-tags: malware,naikon
+  tags: malware,naikon
 
 file:
   - extensions:
diff --git a/file/malware/hash/petya-ransomware-hash.yaml b/file/malware/hash/petya-ransomware-hash.yaml
index 551d7126e9..7540215654 100644
--- a/file/malware/hash/petya-ransomware-hash.yaml
+++ b/file/malware/hash/petya-ransomware-hash.yaml
@@ -7,7 +7,7 @@ info:
     Detects Petya Ransomware.
   reference:
     - http://www.heise.de/newsticker/meldung/Erpressungs-Trojaner-Petya-riegelt-den-gesamten-Rechner-ab-3150917.html
-tags: ransomware,malware
+  tags: ransomware,malware
 
 file:
   - extensions:
diff --git a/file/malware/hash/purplewave-malware-hash.yaml b/file/malware/hash/purplewave-malware-hash.yaml
index aa2ece1518..46a7d320fa 100644
--- a/file/malware/hash/purplewave-malware-hash.yaml
+++ b/file/malware/hash/purplewave-malware-hash.yaml
@@ -6,7 +6,7 @@ info:
   reference:
     - https://twitter.com/3xp0rtblog/status/1289125217751781376
     - https://github.com/Yara-Rules/rules/blob/master/malware/MALW_PurpleWave.yar
-tags: malware,apt,purplewave
+  tags: malware,apt,purplewave
 
 file:
   - extensions:
diff --git a/file/malware/hash/revil-ransomware-hash.yaml b/file/malware/hash/revil-ransomware-hash.yaml
index c6248e390f..9dba28d848 100644
--- a/file/malware/hash/revil-ransomware-hash.yaml
+++ b/file/malware/hash/revil-ransomware-hash.yaml
@@ -8,7 +8,7 @@ info:
   reference:
     - https://angle.ankura.com/post/102hcny/revix-linux-ransomware
     - https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Revix.yar
-tags: ransomware,malware
+  tags: ransomware,malware
 
 file:
   - extensions: