ReversingLabs unknown stable yara

Win32_Virus_DeadCode [virus]

Yara rule that detects DeadCode virus.

View Source

Detection Logic

uint16(0) == 0x5A4D and 
        ((($deadcode_ep_1 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        (($deadcode_ep_2 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        (($deadcode_ep_3 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        ($deadcode_body_1 and $deadcode_body_2))

Field Validations

Loading…

Comments (0)

Loading comments...