Signature Base unknown stable yara

Office_AutoOpen_Macro [yara]

Detects an Microsoft Office file that contains the AutoOpen Macro function

View Source

Detection Logic

(
			uint32be(0) == 0xd0cf11e0 or 	// DOC, PPT, XLS
			uint32be(0) == 0x504b0304		// DOCX, PPTX, XLSX (PKZIP)
		)
		and all of ($s*) and filesize < 300000

Field Validations

Loading…

Comments (0)

Loading comments...