Commit 3410fea7 by mmorenog

Update IndiaGolf.yara

parent 04b9bb37
......@@ -23,20 +23,7 @@ rule IndiaGolf
89 7C 24 24 mov [esp+2A90h+var_2A6C], edi
*/
$generateRandomID = {
FF ??
8B ??
C1 ?? 10
FF ??
03 F8
89 [3]
FF ??
8B ??
C1 ?? 10
FF ??
03 ??
89
}
$generateRandomID = {FF ?? 8B ?? C1 ?? 10 FF ?? 03 F8 89 [3] FF ?? 8B ?? C1 ?? 10 FF ?? 03 ?? 89}
condition:
$generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment