Merge pull request #345 from knowmalware/pe_sections

Fix suspicious_packer_section rule

Merge pull request #345 from knowmalware/pe_sections
Fix suspicious_packer_section rule
508a5a3a · Jaume Martin · GitHub · c80ce1e9 · 5c6545ae · 508a5a3a
Unverified Commit 508a5a3a authored Mar 27, 2019 by Jaume Martin Committed by GitHub Mar 27, 2019
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 1 deletions

MALW_PE_sections.yar malware/MALW_PE_sections.yar +4 -1

No files found.
--- a/malware/MALW_PE_sections.yar
+++ b/malware/MALW_PE_sections.yar
@@ -82,5 +82,8 @@ rule suspicious_packer_section : packer PE {
        $s63 = "UPX!" wide ascii

    condition:
-        (uint16(0) == 0x457f and 1 of them)
+        // DOS stub signature                           PE signature
+        uint16(0) == 0x5a4d and uint32be(uint32(0x3c)) == 0x50450000 and (
+            for any of them : ( $ in (0..1024) )
+        )
 }