Add rule for PE stored as UUID (#1158)

2026-10-12 02:18:39 +00:00 · 2026-05-20 09:09:00 +02:00
parent 89637fba22
commit 2a7f18b12e
1 changed files with 21 additions and 0 deletions
@@ -0,0 +1,21 @@
+rule:
+  meta:
+    name: decode PE stored as UUID
+    namespace: load-code/pe
+    authors:
+      - [email protected]
+    scopes:
+      static: function
+      dynamic: call
+  features:
+    - and:
+      - api: "UuidFromString"
+      - and:
+        - substring: "90909090"
+          description: nops
+        - substring: "00000000"
+        - substring: "-0000-"
+        - substring: "ffffffff"
+        - substring: "-ffff-"
+        - string: /.*4d-?5a.*/
+          description: PE signature