Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
27 lines (24 sloc) 732 Bytes
/***
Yara Rules (ASCII ONLY) file for jsunpackn
http://jsunpack.jeek.org/
Blake Hartstein
blake[@]jeek.org
Last updated 09/18/2009
see "rules" for options that jsunpack supports
This is a special version of the rules file that strips off all non-[a-z] characters
*/
rule PDFHiddenExploit: decodedPDF strip
{ // Basically a copy of PDFexploit, except:
// 1) we strip all characters we don't want
// 2) cannot use fullword
// 3) don't want duplicates if PDFexploit might already catch it
meta:
impact = 8
strings:
$cve20082992 = "utilprintf" nocase
$cve20091493 = "spellcustomDictionaryOpen" nocase
$cve20075659 = "collabcollectEmailInfo" nocase
$cve20090927 = "collabgetIcon" nocase
condition:
1 of them
}