YARA unknown stable yara

maldoc_find_kernel32_base_method_3 [maldocs]

View Source

Detection Logic

for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))

Field Validations

Loading…

Comments (0)

Loading comments...