Add YARA rule for BoxedApp packer detection

Introduces a new rule 'Packer__BoxedApp' to identify PE files packed with BoxedApp by checking for '.bxpck' and '.main' section names. This enhances detection capabilities for packed executables.
This commit is contained in:
DosX 2025-10-02 00:13:14 +03:00
commit 487e77ee76

View file

@ -133,6 +133,17 @@ rule Packer__SimplePack {
)
}
rule Packer__BoxedApp {
condition:
IsPE and
IsNative and (
for any i in (0..pe.number_of_sections - 1) : (
pe.sections[i].name == ".bxpck" and
pe.sections[i + 1].name == ".main"
)
)
}
rule Packer__py2exe {
condition:
IsPE and