diff --git a/yara/gen_Excel4Macro_Sharpshooter.yar b/yara/gen_Excel4Macro_Sharpshooter.yar index 547fc01..9f1ae09 100644 --- a/yara/gen_Excel4Macro_Sharpshooter.yar +++ b/yara/gen_Excel4Macro_Sharpshooter.yar @@ -60,7 +60,7 @@ rule SUSP_Excel4Macro_AutoOpen condition: - filesize < 400KB + filesize < 3000KB and $header_docf at 0 and $s1 and any of ($Auto_*)