Sneed-Reactivity/yara-mikesxrs/malc0de/webc2_qbp_apt1.yar

9 lines
166 B
Text
Raw Normal View History

rule webc2_qbp : apt
{
strings:
$a = "%t?%d-%d-%d="
$b = "Hello@)!0"
$c = "?id="
condition:
filesize < 100KB and (3 of ($a,$b,$c))
}