diff --git a/internal/limitation/file/internal-visual-basic-file-limitation.yml b/internal/limitation/file/internal-visual-basic-file-limitation.yml new file mode 100644 index 00000000..baa47488 --- /dev/null +++ b/internal/limitation/file/internal-visual-basic-file-limitation.yml @@ -0,0 +1,18 @@ +rule: + meta: + name: (internal) Visual Basic file limitation + namespace: internal/limitation/file + author: "@mr-tz" + description: | + This sample appears to be compiled from Visual Basic. + + Visual Basic is a Microsoft programming language that can be compiled to native code or an intermediate + representation called P-Code. + capa cannot handle Visual Basic executables well. This means that the results will be misleading or incomplete. + You may have to analyze the file manually, for example using a tool like VB Decompiler. + scope: file + examples: + - 9bca6b99e7981208af4c7925b96fb9cf + features: + - or: + - match: compiler/vb