Skip to content

R
rules
Commit 10ec5e88 by Marc Rivero López Committed by GitHub
Options

Update packer.yar 

fixed Install shield rule
parent 3f7ba85d
Showing with 8 additions and 5 deletions
Packers/packer.yar
...@@ -10994,18 +10994,21 @@ condition: ...@@ -10994,18 +10994,21 @@ condition:
} }
rule InstallShield2000 rule Install_Shield_2000
{ {
meta: meta:
author="malware-lu" author = "PEiD"
strings: description = "Microsoft Visual C++ 5.0"
group = "15"
function = "16"
strings:
$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 } $a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
condition:
condition:
$a0 at pe.entry_point $a0 at pe.entry_point
} }
rule Obsidium1337ObsidiumSoftware rule Obsidium1337ObsidiumSoftware
{ {
meta: meta:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment