Merge pull request #247 from FliegenEinhorn/master

Thanks!
moving rule maldoc_OLE_file_magic_number to utils/magic.yar

Malicious_Documents/maldoc_somerules.yar

@@ -127,16 +127,6 @@ rule maldoc_getEIP_method_4 : maldoc
         any of them
 }
 
-rule maldoc_OLE_file_magic_number : maldoc
-{
-    meta:
-        author = "Didier Stevens (https://DidierStevens.com)"
-    strings:
-        $a = {D0 CF 11 E0}
-    condition:
-        $a
-}
-
 // 20150909 - Issue #39 - Commented because of High FP rate
 /*
 rule maldoc_suspicious_strings : maldoc

utils/magic.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule maldoc_OLE_file_magic_number : maldoc
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {D0 CF 11 E0}
+    condition:
+        $a
+}