Commit c9987d79 by mmorenog

Update PDF.yar

parent a42fee1d
......@@ -383,7 +383,7 @@ rule invalid_xref_numbers : PDF
strings:
$magic = { 25 50 44 46 }
$reg0 = /xref\r?\n?.*\r?\n?.*65535\sf/
$reg1 = /endstream.*?\r?\n?endobj.*?\r?\n?startxref/
$reg1 = /endstream.*\r?\n?endobj.*\r?\n?startxref/
condition:
$magic at 0 and not $reg0 and not $reg1
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment