diff --git a/tools/yara/packer.yara b/tools/yara/packer.yara index 024e1a5..653a1dd 100755 --- a/tools/yara/packer.yara +++ b/tools/yara/packer.yara @@ -10210,16 +10210,6 @@ condition: } -rule Armadillov171 -{ -strings: - $a0 = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 } - -condition: - $a0 at entrypoint -} - - rule KBySV022shoooo { strings: @@ -14517,6 +14507,7 @@ condition: } +/* false positive - https://www.zscaler.com/blogs/research/your-windows-8-packed rule Armadillov1xxv2xx { strings: @@ -14524,7 +14515,7 @@ strings: condition: $a0 at entrypoint -} +}*/ rule HACKSTOPv111c