Commit 3410fea7 by mmorenog

Update IndiaGolf.yara

parent 04b9bb37
...@@ -23,20 +23,7 @@ rule IndiaGolf ...@@ -23,20 +23,7 @@ rule IndiaGolf
89 7C 24 24 mov [esp+2A90h+var_2A6C], edi 89 7C 24 24 mov [esp+2A90h+var_2A6C], edi
*/ */
$generateRandomID = { $generateRandomID = {FF ?? 8B ?? C1 ?? 10 FF ?? 03 F8 89 [3] FF ?? 8B ?? C1 ?? 10 FF ?? 03 ?? 89}
FF ??
8B ??
C1 ?? 10
FF ??
03 F8
89 [3]
FF ??
8B ??
C1 ?? 10
FF ??
03 ??
89
}
condition: condition:
$generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size)) $generateRandomID in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment