Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modified Visual Basic's Yara rule #992

Merged
merged 1 commit into from
Aug 5, 2021
Merged

Conversation

Dadda97
Copy link
Contributor

@Dadda97 Dadda97 commented Jul 27, 2021

The ThunRTMain function is the one needed to startup a Visual Basic app (can be imported via ordinal), so if it's a VB executable is required to import it.

In addition, the use of ? wildcard may slow down the scanning.

@Dadda97
Copy link
Contributor Author

Dadda97 commented Jul 27, 2021

@xkubov
Copy link
Contributor

xkubov commented Aug 5, 2021

Lets run TC tests.

@xkubov
Copy link
Contributor

xkubov commented Aug 5, 2021

Thank you for the PR. Changes look good and all TC tests passed. Merging.

@xkubov xkubov merged commit e066e93 into avast:master Aug 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants