Signature Base unknown stable yara

SUSP_Macro_Sheet_Obfuscated_Char [yara]

Finding hidden/very-hidden macros with many CHAR functions

View Source

Detection Logic

$ole_marker at 0 and 1 of ($macro_sheet_h*) and #char_func > 10 and $s1

Field Validations

Loading…

Comments (0)

Loading comments...