Sneed-Reactivity/yara-mikesxrs/patrickrolsen/html_exploit_GIF.yar
Sam Sneed 08e8d462fe OMG ISTG PLS WORK
RED PILL 🔴 💊
2024-07-25 12:43:35 -05:00

15 lines
No EOL
354 B
Text

rule html_exploit_GIF
{
meta:
author = "@patrickrolsen"
maltype = "Web Shells"
version = "0.1"
reference = "code.google.com/p/caffsec-malware-analysis"
date = "2013-12-14"
strings:
$magic = {47 49 46 38 ?? 61} // GIF8<version>a
$s1 = {3c 68 74 6d 6c 3e} // <html>
$s2 = {3c 48 54 4d 4c 3e} // <HTML>
condition:
($magic at 0) and (any of ($s*))
}