Skip to content

Modified Visual Basic's Yara rule#992

Merged
xkubov merged 1 commit intoavast:masterfrom
Dadda97:vb-yara-rule
Aug 5, 2021
Merged

Modified Visual Basic's Yara rule#992
xkubov merged 1 commit intoavast:masterfrom
Dadda97:vb-yara-rule

Conversation

@Dadda97
Copy link
Copy Markdown
Contributor

@Dadda97 Dadda97 commented Jul 27, 2021

The ThunRTMain function is the one needed to startup a Visual Basic app (can be imported via ordinal), so if it's a VB executable is required to import it.

In addition, the use of ? wildcard may slow down the scanning.

@Dadda97
Copy link
Copy Markdown
Contributor Author

Dadda97 commented Jul 27, 2021

@xkubov
Copy link
Copy Markdown
Contributor

xkubov commented Aug 5, 2021

Lets run TC tests.

@xkubov
Copy link
Copy Markdown
Contributor

xkubov commented Aug 5, 2021

Thank you for the PR. Changes look good and all TC tests passed. Merging.

@xkubov xkubov merged commit e066e93 into avast:master Aug 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants