Signature Base unknown stable yara

SUSP_Macro_StarOffice [yara]

Suspicious macro in StarOffice

View Source

Detection Logic

filesize < 1MB
        and uint32be(0) == 0x3c3f786d // <?xm
        and all of ($r*)
        and 1 of ($s*)
        and not 1 of ($fp*)

Field Validations

Loading…

Comments (0)

Loading comments...