Skip to content

R
rules
Commit bbb12c4a by mmorenog
Options

Update and rename WhiskeyBravo.yara.error to WhiskeyBravo_mod.yara

parent 4effdfa4
Showing with 2 additions and 1 deletions
malware/Operation_Blockbuster/WhiskeyBravo.yara.error → malware/Operation_Blockbuster/WhiskeyBravo_mod.yara
// This rule has been modified by @mmorenog @yararules to fix some syntax errors, it's not the original rule
import "pe"
......@@ -39,7 +40,7 @@ rule WhiskeyBravo
FF D7 call edi ; _wcsnicmp
*/
$a = {68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 [4] [0-2] 68 [4] 5? (FF D? | E8 [4]) 83 C4 (08 | 0C) 85 C0 0F 84 }
$a = {68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 [4] [0-2] 68 [4] 5? FF D? 83 C4 0C 85 C0 0F 84 }
$ext1 = ".wpd" wide nocase
$ext2 = ".doc" wide nocase
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment