Sneed-Reactivity/yara-mikesxrs/EmersonElectricCo/ft_rar.yara

16 lines
249 B
Text
Raw Normal View History

rule ft_rar
{
meta:
author = "James Ferrer"
company = "Emerson"
lastmod = "20150107"
desc = "File type signature for basic .rar files"
strings:
$Rar = {52 61 72 21 1A 07}
condition:
$Rar at 0
}