mirror of
https://github.com/horsicq/Detect-It-Easy.git
synced 2026-06-24 01:54:08 +00:00
Add py2exe detection to DiE and YARA rules
Added a header comment to the Py2exe.1.sg rule file for clarity. Introduced a new YARA rule to detect py2exe-packed PE files by checking for the 'PyArg_ParseTuple' export.
This commit is contained in:
parent
bd235ceaa9
commit
9ae7963fa9
2 changed files with 10 additions and 0 deletions
|
|
@ -1,3 +1,5 @@
|
|||
// Detect It Easy: detection rule file
|
||||
|
||||
meta("packer", "py2exe");
|
||||
|
||||
function detect() {
|
||||
|
|
|
|||
|
|
@ -133,6 +133,14 @@ rule Packer__SimplePack {
|
|||
)
|
||||
}
|
||||
|
||||
rule Packer__py2exe {
|
||||
condition:
|
||||
IsPE and
|
||||
IsNative and
|
||||
not IsDll and
|
||||
pe.exports("PyArg_ParseTuple")
|
||||
}
|
||||
|
||||
rule Protection__obfus_h {
|
||||
condition:
|
||||
IsPE and
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue