Signature Base unknown stable yara

gen_macro_ShellExecute_action [yara]

VBA macro technique to call ShellExecute to launch payload

View Source

Detection Logic

filesize < 1MB
        and (uint32be(0) == 0x41747472 or uint32be(0) == 0x61747472 or uint32be(0) == 0x41545452)  //File start with Attribute
        and all of ($s*)
        and (all of ($com1*) or all of ($com2*))

Field Validations

Loading…

Comments (0)

Loading comments...