mirror of
https://github.com/vee1e/capa-rules.git
synced 2026-09-02 03:17:19 +00:00
24 lines
687 B
YAML
24 lines
687 B
YAML
rule:
|
|
meta:
|
|
name: allocate memory
|
|
authors:
|
|
- 0x534a@mailbox.org
|
|
lib: true
|
|
scope: basic block
|
|
mbc:
|
|
- Memory::Allocate Memory [C0007]
|
|
examples:
|
|
- Practical Malware Analysis Lab 03-03.exe_:0x4010EA
|
|
# ntdll
|
|
- 563653399B82CD443F120ECEFF836EA3678D4CF11D9B351BB737573C2D856299:0x140001ABA
|
|
features:
|
|
- or:
|
|
- api: kernel32.VirtualAlloc
|
|
- api: kernel32.VirtualAllocEx
|
|
- api: kernel32.VirtualAllocExNuma
|
|
- api: kernel32.VirtualProtect
|
|
- api: kernel32.VirtualProtectEx
|
|
- api: NtAllocateVirtualMemory
|
|
- api: ZwAllocateVirtualMemory
|
|
- api: NtMapViewOfSection
|
|
- api: ZwMapViewOfSection
|