Update APT_PCclient.yar

malware/APT_PCclient.yar

@@ -5,16 +5,18 @@
 
 import "pe"
 
-rule backdoor_apt_pcclient : Backdoor Dropper
+rule backdoor_apt_pcclient
 {
-meta:
+
+    meta:
         author = "@patrickrolsen"
         maltype = "APT.PCCLient"
         filetype = "DLL"
         version = "0.1"
         description = "Detects the dropper: 869fa4dfdbabfabe87d334f85ddda234 AKA dw20.dll/msacm32.drv dropped by 4a85af37de44daf5917f545c6fd03902 (RTF)"
         date = "2012-10"
-strings:
+
+    strings:
         $magic = { 4d 5a } // MZ
         $string1 = "www.micro1.zyns.com"
         $string2 = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)"
@@ -22,6 +24,7 @@ strings:
         $string4 = "C:\\Windows\\Explorer.exe" wide
         $string5 = "Elevation:Administrator!" wide
         $string6 = "C:\\Users\\cmd\\Desktop\\msacm32\\Release\\msacm32.pdb"
-condition:
+
+    condition:
         $magic at 0 and 4 of ($string*)
 }