Signature Base unknown stable yara

APT_APT29_NOBELIUM_BoomBox_PDF_Masq_May21_1 [yara]

Detects PDF documents as used by BoomBox as described in APT29 NOBELIUM report

View Source

Detection Logic

$ah1 at 0 and $af1 at (filesize-7) and filesize < 100KB
      and not 1 of ($fp*)
      and math.entropy(16,filesize) > 7

Field Validations

Loading…

Comments (0)

Loading comments...