mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Add YARA rule for BoxedApp packer detection
Introduces a new rule 'Packer__BoxedApp' to identify PE files packed with BoxedApp by checking for '.bxpck' and '.main' section names. This enhances detection capabilities for packed executables.
This commit is contained in:
parent
9ae7963fa9
commit
487e77ee76
1 changed files with 11 additions and 0 deletions
|
|
@ -133,6 +133,17 @@ rule Packer__SimplePack {
|
|||
)
|
||||
}
|
||||
|
||||
rule Packer__BoxedApp {
|
||||
condition:
|
||||
IsPE and
|
||||
IsNative and (
|
||||
for any i in (0..pe.number_of_sections - 1) : (
|
||||
pe.sections[i].name == ".bxpck" and
|
||||
pe.sections[i + 1].name == ".main"
|
||||
)
|
||||
)
|
||||
}
|
||||
|
||||
rule Packer__py2exe {
|
||||
condition:
|
||||
IsPE and
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue