Signature Base unknown stable yara

SUSP_Sysinternals_Desktops_Anomaly_Feb25 [yara]

Detects anomalies in Sysinternals Desktops binaries

View Source

Detection Logic

uint16(0) == 0x5a4d
      and filesize > 350KB
      and all of them

Field Validations

Loading…

Comments (0)

Loading comments...