Sorry didt look enough but i solved it:
rule Parite : Might_Be_Malware
{
meta:
author="me"
strings:
$a0 = { 98 05 00 00 }
condition:
pe.sections[pe.section_index(pe.entry_point)].name contains "\x07"
and
pe.sections[pe.section_index(pe.entry_point)].name contains "." and
$a0
}
--
You received this message because you are subscribed to the Google Groups
"YARA" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
