22 lines
518 B
Text
22 lines
518 B
Text
|
rule BLOWFISH_Constants {
|
||
|
|
meta:
|
||
|
|
author = "phoul (@phoul)"
|
||
|
|
description = "Look for Blowfish constants"
|
||
|
|
date = "2014-01"
|
||
|
|
version = "0.1"
|
||
|
|
strings:
|
||
|
|
$c0 = { D1310BA6 }
|
||
|
|
$c1 = { A60B31D1 }
|
||
|
|
$c2 = { 98DFB5AC }
|
||
|
|
$c3 = { ACB5DF98 }
|
||
|
|
$c4 = { 2FFD72DB }
|
||
|
|
$c5 = { DB72FD2F }
|
||
|
|
$c6 = { D01ADFB7 }
|
||
|
|
$c7 = { B7DF1AD0 }
|
||
|
|
$c8 = { 4B7A70E9 }
|
||
|
|
$c9 = { E9707A4B }
|
||
|
|
$c10 = { F64C261C }
|
||
|
|
$c11 = { 1C264CF6 }
|
||
|
|
condition:
|
||
|
|
6 of them
|
||
|
|
}
|