Sneed-Reactivity/yara-mikesxrs/EmersonElectricCo/ft_swf.yara
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

51 lines
840 B
Text

rule ft_swf_cws
{
meta:
author = "Jason Batchelor"
company = "Emerson"
lastmod = "20150318"
desc = "File type signature for regular compressed SWF files"
strings:
$cws = "CWS"
condition:
$cws at 0
}
rule ft_swf_fws
{
meta:
author = "Jason Batchelor"
company = "Emerson"
lastmod = "20150318"
desc = "File type signature for basic SWF files."
strings:
$fws = "FWS"
condition:
$fws at 0
}
rule ft_swf_zws
{
meta:
author = "Jason Batchelor"
company = "Emerson"
lastmod = "20150318"
desc = "File type signature for SWF files compressed with LZMA compression, uncommonly observed"
strings:
$zws = "ZWS"
condition:
$zws at 0
}
rule ft_swf
{
condition:
ft_swf_zws or ft_swf_fws or ft_swf_cws
}