vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Delete parse-pe-exports.yml

Browse source
This commit is contained in:
Ryan Xu 2021-11-22 11:26:06 -05:00 • committed by GitHub
parent e61a31966e
commit 1cf2dbb47d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 0 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

22
load-code/pe/parse-pe-exports.yml
View file

@ -1,22 +0,0 @@
rule:
meta:
name: parse PE exports
namespace: load-code/pe
author: "@Ana06"
scope: function
mbc:
- Discovery::Code Discovery::Parse PE Header [B0046.003]
references:
- Practical Malware Analysis, Chapter 19
examples:
- E4C33AC3638EEF68311F8AC0D72483C7:0x401390
features:
- and:
- offset: 0x3C = IMAGE_DOS_HEADER.e_lfanew
- or:
- offset/x32: 0x78 = IMAGE_NT_HEADERS32.OptionalHeader.DataDirectory.VirtualAddress
- offset/x64: 0x88 = IMAGE_NT_HEADERS64.OptionalHeader.DataDirectory.VirtualAddress
- offset: 0x18 = IMAGE_EXPORT_DIRECTORY.NumberOfNames
- offset: 0x20 = IMAGE_EXPORT_DIRECTORY.AddressOfNames
- offset: 0x24 = IMAGE_EXPORT_DIRECTORY.AddressOfNameOrdinals
- offset: 0x1C = IMAGE_EXPORT_DIRECTORY.AddressOfFunctions