Signature Base unknown stable yara

SUSP_Bad_PDF [yara]

Detects PDF that embeds code to steal NTLM hashes

View Source

Detection Logic

( uint32(0) == 0x46445025 or uint32(0) == 0x4450250a ) and 1 of them

Field Validations

Loading…

Comments (0)

Loading comments...