14 lines
377 B
Text
14 lines
377 B
Text
|
import "pe"
|
||
|
|
rule Check_FilePaths
|
||
|
|
{
|
||
|
|
meta:
|
||
|
|
Author = "Nick Hoffman"
|
||
|
|
Description = "Checks for filepaths containing popular sandbox names"
|
||
|
|
Sample = "de1af0e97e94859d372be7fcf3a5daa5"
|
||
|
|
strings:
|
||
|
|
$path1 = "SANDBOX" wide ascii
|
||
|
|
$path2 = "\\SAMPLE" wide ascii
|
||
|
|
$path3 = "\\VIRUS" wide ascii
|
||
|
|
condition:
|
||
|
|
all of ($path*) and pe.imports("kernel32.dll","GetModuleFileNameA")
|
||
|
|
}
|