Fix #420

56c5e06b · Jaume Martin · d1851b63 · 09d6f650 · 56c5e06b
Commit 56c5e06b authored Oct 08, 2021 by Jaume Martin
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletions

Maldoc_CVE_2017_11882.yar maldocs/Maldoc_CVE_2017_11882.yar +2 -1

No files found.
--- a/maldocs/Maldoc_CVE_2017_11882.yar
+++ b/maldocs/Maldoc_CVE_2017_11882.yar
@@ -9,10 +9,11 @@ rule Maldoc_CVE_2017_11882 : Exploit {
        reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8"
        date = "2017-10-20"
    strings:
+        $doc = "d0cf11e0a1b11ae1"
        $s0 = "Equation"
        $s1 = "1c000000020"
        $h0 = {1C 00 00 00 02 00}

    condition: 
-        $s0 and ($h0 or $s1)
+        (uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)
 }