Signature Base unknown stable yara

SUSP_GIF_Anomalies [yara]

Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type

View Source

Detection Logic

uint16(0) == 0x4947 and uint8(2) == 0x46 /* GIF */
      and uint8(11) != 0x00 /* Background Color Index != 0 */
      and uint8(12) != 0x00 /* Pixel Aspect Ratio != 0 */
      and uint8(filesize-1) != 0x3b /* Trailer (trailes are often 0x00 byte padded and cannot server as sole indicator) */

Field Validations

Loading…

Comments (0)

Loading comments...