13 lines
No EOL
467 B
Text
13 lines
No EOL
467 B
Text
rule APT_NGO_wuaclt_PDF
|
|
{
|
|
meta:
|
|
author = "@iocbucket"
|
|
description = "Yara rule for the PDF delivery vehicle and Communications based on APT 1"
|
|
|
|
strings:
|
|
$pdf = "%PDF" nocase
|
|
$comment = {3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A}
|
|
|
|
condition:
|
|
$pdf at 0 and $comment in (0..200)
|
|
} |