Skip to content

R
rules
Commit 56c5e06b by Jaume Martin
Options

Fix #420

parents d1851b63 09d6f650
Showing with 2 additions and 1 deletions
maldocs/Maldoc_CVE_2017_11882.yar
...@@ -9,10 +9,11 @@ rule Maldoc_CVE_2017_11882 : Exploit { ...@@ -9,10 +9,11 @@ rule Maldoc_CVE_2017_11882 : Exploit {
reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8" reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8"
date = "2017-10-20" date = "2017-10-20"
strings: strings:
$doc = "d0cf11e0a1b11ae1"
$s0 = "Equation" $s0 = "Equation"
$s1 = "1c000000020" $s1 = "1c000000020"
$h0 = {1C 00 00 00 02 00} $h0 = {1C 00 00 00 02 00}
condition: condition:
$s0 and ($h0 or $s1) (uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)
} }
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment