-
Fix suspicious_packer_section rule · 5c6545ae
1. The check of first two bytes was wrong for PE files. 2. Limit the search to the first 1024 bytes of the files, which should be sufficient to match on section names.
Frank Poz authored
×
1. The check of first two bytes was wrong for PE files. 2. Limit the search to the first 1024 bytes of the files, which should be sufficient to match on section names.