22 lines
497 B
Text
22 lines
497 B
Text
|
rule MD5_Constants {
|
||
|
|
meta:
|
||
|
|
author = "phoul (@phoul)"
|
||
|
|
description = "Look for MD5 constants"
|
||
|
|
date = "2014-01"
|
||
|
|
version = "0.2"
|
||
|
|
strings:
|
||
|
|
// Init constants
|
||
|
|
$c0 = { 67452301 }
|
||
|
|
$c1 = { efcdab89 }
|
||
|
|
$c2 = { 98badcfe }
|
||
|
|
$c3 = { 10325476 }
|
||
|
|
$c4 = { 01234567 }
|
||
|
|
$c5 = { 89ABCDEF }
|
||
|
|
$c6 = { FEDCBA98 }
|
||
|
|
$c7 = { 76543210 }
|
||
|
|
// Round 2
|
||
|
|
$c8 = { F4D50d87 }
|
||
|
|
$c9 = { 78A46AD7 }
|
||
|
|
condition:
|
||
|
|
5 of them
|
||
|
|
}
|