Skip to content

R
rules
Commit 4fe01a0c by Marc Rivero López
Options

Updated peid signature file

parent 10ec5e88
Showing with 11 additions and 7 deletions
Packers/peid.yar
......@@ -28883,13 +28883,17 @@ rule ANDpakk2_018_by_Dmitry_quotANDquot_Andreev: PEiD
}
rule InstallShield_2000: PEiD
{
strings:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
condition:
$a at pe.entry_point
rule Install_Shield_2000
{
meta:
author = "PEiD"
description = "Microsoft Visual C++ 5.0"
group = "15"
function = "16"
strings:
$a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 C4 ?? 53 56 57 }
condition:
$a0 at pe.entry_point
}
rule SimbiOZ_Poly_21_Extranger: PEiD
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment