YARA unknown stable yara

HasModified_DOS_Message [packers]

DOS Message Check

Detection Logic

// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and not
		(for any of ($a*) : ($ in (0x0..uint32(0x3c) )))

Field Validations

Loading…

Comments (0)

Loading comments...