YARA unknown stable yara

MALW_PurpleWave_v1 [malware]

View Source

Detection Logic

($MZ at 0 and $decoderoutine) and
	(
		(5 of ($string*) and all of ($alphabet*))
	)

	and filesize < 700KB // Standard size when not packed should be arround ~598/600kb

Field Validations

Loading…

Comments (0)

Loading comments...