valitydev/signature-base
14
0
Fork 0
mirror of https://github.com/valitydev/signature-base.git synced 2024-11-06 10:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

NullSoftInst FPs

Browse Source
This commit is contained in:
Florian Roth 2020-10-06 23:00:53 +02:00
parent 10d608c738
commit edacb6a755
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
yara/gen_anomalies_keyword_combos.yar
View File

@ -18,6 +18,12 @@ rule SUSP_NullSoftInst_Combo_Oct20_1 {
$fp1 = "nsisinstall" fullword ascii $fp1 = "nsisinstall" fullword ascii
$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide $fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
$fp3 = "Apache Tomcat" wide fullword
$fp4 = "Bot Framework Emulator" wide fullword
$fp5 = "Firefox Helper" wide fullword
$fp6 = "Paint.NET Setup" wide fullword
$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
$fp8 = "License: MPL 2" wide
condition: condition:
uint16(0) == 0x5a4d and uint16(0) == 0x5a4d and
filesize < 2000KB and filesize < 2000KB and