vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 19:07:15 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

add VB limitation

Browse source
This commit is contained in:
Moritz Raabe 2021-06-08 15:24:23 +02:00
parent 87ed77380d
commit ab707a9876
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
internal/limitation/file/internal-visual-basic-file-limitation.yml Normal file
View file

@ -0,0 +1,18 @@
rule:
meta:
name: (internal) Visual Basic file limitation
namespace: internal/limitation/file
author: "@mr-tz"
description: |
This sample appears to be compiled from Visual Basic.
Visual Basic is a Microsoft programming language that can be compiled to native code or an intermediate
representation called P-Code.
capa cannot handle Visual Basic executables well. This means that the results will be misleading or incomplete.
You may have to analyze the file manually, for example using a tool like VB Decompiler.
scope: file
examples:
- 9bca6b99e7981208af4c7925b96fb9cf
features:
- or:
- match: compiler/vb