mandiant/capa-rules
1
0
Fork 0
mirror of https://github.com/mandiant/capa-rules.git synced 2026-10-12 02:18:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

embedded pe: via strings

Browse Source 
closes #319
This commit is contained in:
Willi Ballenthin
2021-04-14 12:34:57 -06:00
committed by GitHub
parent faefbdbacd
commit b21ca8d120
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
executable/subfile/pe/contain-an-embedded-pe-file.yml
+3 -1
View File
@@ -9,4 +9,6 @@ rule:
examples:
- Practical Malware Analysis Lab 01-04.exe_:0x4060
features:
- count(characteristic(embedded pe)): 1 or more
- or:
- count(characteristic(embedded pe)): 1 or more
- count(string(This program cannot be run in DOS mode.)): 2 or more