YARA unknown stable yara

HasTaggantSignature [packers]

TaggantSignature Check

View Source

Detection Logic

// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		uint32(uint32(0x3C)) == 0x00004550 and
		//TAGG+4E==packerid
		//(uint32be(@a0+0x4E) == 0x0B51D132) and
		//(uint32be(@a0+0x12) == 0x006092a86) and
		//(uint32be(@a0+0x12)) == uint32be(@c0) and

		//uint32be(@a0+0x04) < (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) and
		$a0

Field Validations

Loading…

Comments (0)

Loading comments...