YARA unknown stable yara

IsDLL [packers]

View Source

Detection Logic

// MZ signature at offset 0 and ...
		uint16(0) == 0x5A4D and
		// ... PE signature at offset stored in MZ header at 0x3C
		(uint16(uint32(0x3C)+0x16) & 0x2000) == 0x2000

Field Validations

Loading…

Comments (0)

Loading comments...