Skip to content

R
rules
Commit 2957ce6a by halos
Options

New suspicious launch action

parent 4f540ed8
Showing with 2 additions and 1 deletions
Malicious_Documents/Maldoc_PDF.yar
......@@ -219,7 +219,8 @@ rule suspicious_launch_action : PDF raw
$attrib0 = /\/Launch/
$attrib1 = /\/URL /
$attrib2 = /\/Action/
$attrib3 = /\/F /
$attrib3 = /\/OpenAction/
$attrib4 = /\/F /
condition:
$magic in (0..1024) and 3 of ($attrib*)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment