Update LimaBravo.yara

b577e473 · mmorenog · 19fc17cc · b577e473
Commit b577e473 authored Feb 25, 2016 by mmorenog
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 10 deletions

LimaBravo.yara malware/Operation_Blockbuster/LimaBravo.yara +1 -10

No files found.
--- a/malware/Operation_Blockbuster/LimaBravo.yara
+++ b/malware/Operation_Blockbuster/LimaBravo.yara
@@ -20,16 +20,7 @@ rule LimaBravo
 		E8 97 01 00 00  call    ManualImageLoad
 	*/

-	$a = {
-			83 ?? 34 
-			83 ?? 0A 
-			[0-2] 
-			7E ?? 
-			5? 
-			C6 ?? 4D 
-			C6 [2] 5A 
-			E8 
-		}
+	$a = {83 ?? 34 83 ?? 0A [0-2] 7E ?? 5? C6 ?? 4D C6 [2] 5A E8}

 	condition:
 		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))