PR for issue #275

This should reduce the number of FP when scanning non-PE files

PR for issue #275
This should reduce the number of FP when scanning non-PE files
ff2dd04c · c904370 · GitHub · 56cf8004 · ff2dd04c
Unverified Commit ff2dd04c authored Nov 10, 2017 by c904370 Committed by GitHub Nov 10, 2017
Show whitespace changes
Inline Side-by-side

Showing with 1 additions and 1 deletions

MALW_PE_sections.yar malware/MALW_PE_sections.yar +1 -1

No files found.
--- a/malware/MALW_PE_sections.yar
+++ b/malware/MALW_PE_sections.yar
@@ -82,5 +82,5 @@ rule suspicious_packer_section : packer PE {
        $s63 = "UPX!" wide ascii
    condition:
-        1 of them
+        (uint16(0) == 0x457f and 1 of them)
 }