diff --git a/load-code/pe/parse-pe-exports.yml b/load-code/pe/parse-pe-exports.yml deleted file mode 100644 index 94139688..00000000 --- a/load-code/pe/parse-pe-exports.yml +++ /dev/null @@ -1,22 +0,0 @@ -rule: - meta: - name: parse PE exports - namespace: load-code/pe - author: "@Ana06" - scope: function - mbc: - - Discovery::Code Discovery::Parse PE Header [B0046.003] - references: - - Practical Malware Analysis, Chapter 19 - examples: - - E4C33AC3638EEF68311F8AC0D72483C7:0x401390 - features: - - and: - - offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew - - or: - - offset/x32: 0x78 = IMAGE_NT_HEADERS32.OptionalHeader.DataDirectory.VirtualAddress - - offset/x64: 0x88 = IMAGE_NT_HEADERS64.OptionalHeader.DataDirectory.VirtualAddress - - offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames - - offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames - - offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals - - offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions