Commit fe775b56 by Marc Rivero López Committed by GitHub

Update APT_APT17.yar

Fixed a space
parent 5fcf7a00
......@@ -24,6 +24,7 @@ rule APT17_Sample_FXSST_DLL
$s5 = "HeapAlloc"
$s6 = "GetProcessHeap"
$s7 = "GetCommandLine"
condition:
condition:
uint16(0) == 0x5a4d and filesize < 800KB and ( 1 of ($x*) or all of ($y*) ) and all of ($s*)
}
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment