Skip to content

R
rules
Unverified Commit 09d6f650 by Bondey Committed by GitHub
Options

Update Maldoc_CVE_2017_11882.yar 

now it only detects documents
parent 8e1c877f
Showing with 2 additions and 1 deletions
Malicious_Documents/Maldoc_CVE_2017_11882.yar
...@@ -5,10 +5,11 @@ rule Maldoc_CVE_2017_11882 : Exploit { ...@@ -5,10 +5,11 @@ rule Maldoc_CVE_2017_11882 : Exploit {
reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8" reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8"
date = "2017-10-20" date = "2017-10-20"
strings: strings:
$doc = "d0cf11e0a1b11ae1"
$s0 = "Equation" $s0 = "Equation"
$s1 = "1c000000020" $s1 = "1c000000020"
$h0 = {1C 00 00 00 02 00} $h0 = {1C 00 00 00 02 00}
condition: condition:
$s0 and ($h0 or $s1) (uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment