Disable Armadillov171 PEiD signatures

026d9c21 · wesinator · 1e9f6022 · 026d9c21
Commit 026d9c21 authored Dec 26, 2018 by wesinator
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 10 deletions

peid.yar Packers/peid.yar +2 -10

No files found.
--- a/Packers/peid.yar
+++ b/Packers/peid.yar
@@ -6037,6 +6037,7 @@ rule Armadillo_v177: PEiD

 }

+/* False positive - #39
 rule Armadillo_v171: PEiD
 {
    strings:
@@ -6044,7 +6045,7 @@ rule Armadillo_v171: PEiD
    condition:
        $a at pe.entry_point

-}
+}*/

 rule AsCrypt_v01_SToRM_4: PEiD
 {
@@ -32810,15 +32811,6 @@ rule _PseudoSigner_01_Macromedia_Flash_Projector_60_Anorganix: PEiD

 }

-rule Armadillo_v171_additional: PEiD
-{
-    strings:
-        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 }
-    condition:
-        $a at pe.entry_point
-
-}
-
 rule VProtector_vcasm_additional: PEiD
 {
    strings: