Commit 51d86daf by mmorenog

Update WhiskeyCharlie.yara

parent b38affd8
......@@ -43,41 +43,8 @@ rule WhiskeyCharlie
F7 F9 idiv ecx
*/
$a = {
66 89 55 DC
E8 [4]
6A 0C
99
59
F7 F9
42
66 89 55 DE
E8 [4]
6A 1C
99
59
F7 F9
42
66 89 55 E2
E8 [4]
6A 18
99
59
F7 F9
66 89 55 E4
E8 [4]
6A 3C
99
59
F7 F9
66 89 55 E6
E8 [4]
6A 3C
99
59
F7 F9
}
$a = {66 89 55 DC E8 [4] 6A 0C 99 59 F7 F9 42 66 89 55 DE E8 [4] 6A 1C 99 59 F7 F9 42 66 89 55 E2 E8 [4] 6A 18 99 59 F7 F9 66 89 55 E4 E8 [4] 6A 3C 99 59 F7 F9 66 89 55 E6 E8 [4] 6A 3C 99 59 F7 F9 }
condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
\ No newline at end of file
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment