Skip to content

R
rules
Commit a42fee1d by mmorenog
Options

Update PDF.yar

parent b9eae1ee
Showing with 1 additions and 1 deletions
Malicious_Documents/PDF.yar
...@@ -383,7 +383,7 @@ rule invalid_xref_numbers : PDF ...@@ -383,7 +383,7 @@ rule invalid_xref_numbers : PDF
strings: strings:
$magic = { 25 50 44 46 } $magic = { 25 50 44 46 }
$reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/ $reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/
$reg1 = /.*?\r?\n?endstream.*?\r?\n?endobj.*?\r?\n?startxref.*?\r?\n?/ $reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?startxref/
condition: condition:
$magic at 0 and not $reg0 and not $reg1 $magic at 0 and not $reg0 and not $reg1
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment