vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-01 10:58:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

embedded pe: via strings

Browse source 
closes #319
This commit is contained in:
Willi Ballenthin 2021-04-14 12:34:57 -06:00 • committed by GitHub
parent faefbdbacd
commit b21ca8d120
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
executable/subfile/pe/contain-an-embedded-pe-file.yml
View file

@ -9,4 +9,6 @@ rule:
examples:
- Practical Malware Analysis Lab 01-04.exe_:0x4060
features:
- count(characteristic(embedded pe)): 1 or more
- or:
- count(characteristic(embedded pe)): 1 or more
- count(string(This program cannot be run in DOS mode.)): 2 or more