Magic-Mirror/retdec
1
0
Fork 0
mirror of https://github.com/avast/retdec.git synced 2025-02-25 08:11:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added YARA rule for VISEMAN installer

Browse Source
This commit is contained in:
Ladislav Zezula 2020-10-13 16:39:01 +02:00
parent ab54a03e97
commit 467a82a82f
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
support/yara_patterns/tools/pe/x86/installers.yara
View File

@ -642,6 +642,16 @@ rule thinstall_3348_3350_vs {
$1 at pe.entry_point
}
rule viseman {
meta:
tool = "I"
name = "Viseman Installer"
condition:
pe.overlay.offset != 0 and
pe.overlay.size > 4 and
uint32(pe.overlay.offset) == 0x56495345 // Reversed "VISE"
}
rule wise_installer_uv_01 {
meta:
tool = "I"