Skip to content

R
rules
Commit b38affd8 by mmorenog
Options

Update WhiskeyBravo.yara

parent accd13fd
Showing with 1 additions and 24 deletions
malware/Operation_Blockbuster/WhiskeyBravo.yara
...@@ -38,30 +38,7 @@ rule WhiskeyBravo ...@@ -38,30 +38,7 @@ rule WhiskeyBravo
FF D7 call edi ; _wcsnicmp FF D7 call edi ; _wcsnicmp
*/ */
$a = { $a = {68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 }
68 [4]
5?
(FF D? | E8 [4])
83 C4 (08 | 0C)
85 C0
0F 84 [4]
[0-2]
68 [4]
5?
(FF D? | E8 [4])
83 C4 (08 | 0C)
85 C0
0F 84 [4]
[0-2]
68 [4]
5?
(FF D? | E8 [4])
83 C4 (08 | 0C)
85 C0
0F 84
}
$ext1 = ".wpd" wide nocase $ext1 = ".wpd" wide nocase
$ext2 = ".doc" wide nocase $ext2 = ".doc" wide nocase
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment