YARA unknown stable yara

Maldoc_CVE_2017_11882 [maldocs]

Detects maldoc With exploit for CVE_2017_11882

View Source

Detection Logic

(uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)

Field Validations

Loading…

Comments (0)

Loading comments...