YARA unknown stable yara

office_document_vba [maldocs]

Office document with embedded VBA

View Source

Detection Logic

($officemagic at 0 and any of ($97str*)) or ($zipmagic at 0 and any of ($xmlstr*))

Field Validations

Loading…

Comments (0)

Loading comments...