YARA unknown stable yara

Contains_VBA_macro_code [maldocs]

Detect a MS Office document with embedded VBA macro code

View Source

Detection Logic

($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))

Field Validations

Loading…

Comments (0)

Loading comments...