Commit bba6b142 by mmorenog

Update IndiaDelta.yara

parent 2551753b
......@@ -23,15 +23,15 @@ rule IndiaDelta
FF 15 E0 2D 41 00 call SetFilePointer_0
*/
$a = {
$a = {
FF 15 [4-12]
3? 78 56 34 12
[0-2]
8? ?? 78 56 34 12
[0-10]
FF 15
}
}
condition:
$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))
}
\ No newline at end of file
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment