Signature Base unknown stable yara

Dropper_LNK_LNKSmasher_1 [yara]

The LNKSmasher project contains a prebuilt LNK file that has pieces added based on various configuration items. Because of this, several artifacts are present in every single LNK file generated by LNKSmasher, including the Drive Serial #, the File Droid GUID, and the GUID CLSID.

View Source

Detection Logic

$header at 0 and all of them

Field Validations

Loading…

Comments (0)

Loading comments...