Advertisement
James_inthe_box

Quick possible amedey yara

Jul 18th, 2019
645
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 0.44 KB | None | 0 0
  1. rule amadey_new_bin_mem
  2. {
  3. strings:
  4. $string1 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32"
  5. $string2 = "w32_sharedptr->size == sizeof(W32_EH_SHARED)"
  6. $string3 = "%s:%u: failed assertion `%s'"
  7. $string4 = "../../gcc/gcc/config/i386/w32-shared-ptr.c"
  8. $string5 = "GetAtomNameA (atom, s, sizeof(s)) != 0"
  9. $string6 = "BypassUAC"
  10. $string7 = "AutoRunCmd"
  11.  
  12. condition:
  13. all of them
  14. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement