Signature Base unknown stable yara

LNK_Malicious_Nov1 [yara]

Detects a suspicious LNK file

View Source

Detection Logic

( uint32(0) == 0x0000004c and filesize < 4KB and $c1 and 1 of ($s*) )
      and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...