Skip to content

Modified AutoHotKey's Yara rule#991

Merged
xkubov merged 1 commit intoavast:masterfrom
Dadda97:ahk-yara-rule
Aug 5, 2021
Merged

Modified AutoHotKey's Yara rule#991
xkubov merged 1 commit intoavast:masterfrom
Dadda97:ahk-yara-rule

Conversation

@Dadda97
Copy link
Copy Markdown
Contributor

@Dadda97 Dadda97 commented Jul 27, 2021

The Ahk2Exe compiler allows to change the name of the section ">AUTOHOTKEY SCRIPT<" with an arbitrary string.

The proposed rule adds the check on some strings from the embedded interpreter.

Example of sample escaping the previous rule: 09e7d7d9312f8a02e70690a96015136bdeed63dd0f115ab1293091affeba8661

@xkubov
Copy link
Copy Markdown
Contributor

xkubov commented Aug 5, 2021

Lets run TC tests.

@xkubov
Copy link
Copy Markdown
Contributor

xkubov commented Aug 5, 2021

The extension of the rule looks good to me. TC tests passed -> merging. Thank you for your contribution.

@xkubov xkubov merged commit a192dc2 into avast:master Aug 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants