Commit 47939a0e by mmorenog

Update PDF.yar

parent bb2bce5a
......@@ -383,9 +383,7 @@ rule invalid_xref_numbers : PDF
strings:
$magic = { 25 50 44 46 }
$reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/
$reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?.*startxref/
$reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?startxref.*?\r?\n?/
condition:
$magic at 0 and not $reg0 and not $reg1
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment