Skip to content

R
rules
Commit 36f83378 by mmorenog
Options

Update PDF.yar

parent 5d94f30c
Showing with 2 additions and 1 deletions
Malicious_Documents/PDF.yar
...@@ -178,7 +178,7 @@ rule multiple_filtering : PDF ...@@ -178,7 +178,7 @@ rule multiple_filtering : PDF
strings: strings:
$magic = { 25 50 44 46 } $magic = { 25 50 44 46 }
$attrib = /\/Filter.*?(\/ASCIIHexDecode\W+|\/LZWDecode\W+|\/ASCII85Decode\W+|\/FlateDecode\W+|\/RunLengthDecode){2}/ $attrib = /\/Filter.*?(\/ASCIIHexDecode\W+|\/LZWDecode\W+|\/ASCII85Decode\W+|\/FlateDecode\W+|\/RunLengthDecode){2}/
// left out: /CCITTFaxDecode, JBIG2Decode, DCTDecode, JPXDecode, Crypt // left out: /CCITTFaxDecode, JBIG2Decode, DCTDecode, JPXDecode, Crypt
condition: condition:
...@@ -404,6 +404,7 @@ rule invalid_xref_numbers : PDF ...@@ -404,6 +404,7 @@ rule invalid_xref_numbers : PDF
$magic at 0 and not $reg0 and not $reg1 $magic at 0 and not $reg0 and not $reg1
} }
rule js_splitting : PDF rule js_splitting : PDF
{ {
meta: meta:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment