YARA unknown stable yara

maldoc_indirect_function_call_2 [maldocs]

View Source

Detection Logic

for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))

Field Validations

Loading…

Comments (0)

Loading comments...