Magic-Mirror/retdec
1
0
Fork 0
mirror of https://github.com/avast/retdec.git synced 2025-02-25 08:11:37 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #868 from avast/LZ_Installer_Viseman

Browse Source 
Added YARA rule for VISEMAN installer
This commit is contained in:
Petr Zemek 2020-10-14 07:25:42 +02:00 committed by GitHub
commit c3df2c4806
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
support/yara_patterns/tools/pe/x86/installers.yara
View File

@ -642,6 +642,16 @@ rule thinstall_3348_3350_vs {
$1 at pe.entry_point
}
rule viseman {
meta:
tool = "I"
name = "Viseman Installer"
condition:
pe.overlay.offset != 0 and
pe.overlay.size > 4 and
uint32(pe.overlay.offset) == 0x56495345 // Reversed "VISE"
}
rule wise_installer_uv_01 {
meta:
tool = "I"