Commit 34cf1e67 by mmorenog Committed by GitHub

Delete Miscelanea_RTF.yar

parent 97a7c2db
/*
This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
import "pe"
rule rtf_multiple
{
meta:
author = "@patrickrolsen"
maltype = "Multiple"
version = "0.1"
reference = "fd69a799e21ccb308531ce6056944842"
date = "01/04/2014"
strings:
$rtf = { 7b 5c 72 74 ?? ?? } // {\rt01 {\rtf1 {\rtxa
$string1 = "author user"
$string2 = "title Vjkygdjdtyuj" nocase
$string3 = "company ooo"
$string4 = "password 00000000"
condition:
($rtf at 0) and (all of ($string*))
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment