Signature Base unknown stable yara

Acrotray_Anomaly [yara]

Detects an acrotray.exe that does not contain the usual strings

View Source

Detection Logic

uint16(0) == 0x5a4d and filesize < 3000KB
      and (filename == "acrotray.exe" or filename == "AcroTray.exe")
      and not all of ($s*)

Field Validations

Loading…

Comments (0)

Loading comments...