Commit 09a1b1dd by mmorenog

Update Adwind_JAR_PACKA.yar

parent f65206e4
...@@ -4,15 +4,15 @@ ...@@ -4,15 +4,15 @@
*/ */
rule Adwind_JAR_PACKA { rule Adwind_JAR_PACKA {
meta: meta:
author = “Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com” author = "Vitaly Kamluk, Vitaly.Kamluk@kaspersky.com"
reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf" reference = "https://securelist.com/securelist/files/2016/02/KL_AdwindPublicReport_2016.pdf"
last_modi ed = “2015-11-30” last_modi ed = "2015-11-30"
strings: strings:
$b1 = “.class” ascii $b1 = ".class" ascii
$b2 = “c/a/a/” ascii $b2 = "c/a/a/" ascii
$b3 = “b/a/” ascii $b3 = "b/a/" ascii
$b4 = “a.dat” ascii $b4 = "a.dat" ascii
$b5 = “META-INF/MANIFEST.MF” ascii $b5 = "META-INF/MANIFEST.MF" ascii
condition: condition:
int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5) int16(0) == 0x4B50 and ($b1 and $b2 and $b3 and $b4 and $b5)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment