Sneed-Reactivity/yara-mikesxrs/malc0de/webc2_yahoo_apt1.yar

9 lines
170 B
Text
Raw Permalink Normal View History

rule webc2_yahoo : apt
{
strings:
$a = "<yahoo sb="
$b = "<yahoo ex="
$c = "letusgo"
condition:
filesize < 100KB and (3 of ($a,$b,$c))
}