17 lines
539 B
Text
17 lines
539 B
Text
|
rule Check_Dlls
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "Nick Hoffman"
|
||
|
|
Description = "Checks for common sandbox dlls"
|
||
|
|
Sample = "de1af0e97e94859d372be7fcf3a5daa5"
|
||
|
|
strings:
|
||
|
|
$dll1 = "sbiedll.dll" wide nocase ascii fullword
|
||
|
|
$dll2 = "dbghelp.dll" wide nocase ascii fullword
|
||
|
|
$dll3 = "api_log.dll" wide nocase ascii fullword
|
||
|
|
$dll4 = "dir_watch.dll" wide nocase ascii fullword
|
||
|
|
$dll5 = "pstorec.dll" wide nocase ascii fullword
|
||
|
|
$dll6 = "vmcheck.dll" wide nocase ascii fullword
|
||
|
|
$dll7 = "wpespy.dll" wide nocase ascii fullword
|
||
|
|
condition:
|
||
|
|
2 of them
|
||
|
|
}
|