Fix Yara :)

This commit is contained in:
Benjamin DELPY 2015-05-16 00:14:22 +02:00
parent a36e552549
commit d7a76c08c8

View File

@ -100,5 +100,5 @@ rule power_pe_injection
$str_loadlib = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
condition:
$str_loadlib or $hex_loadlib
$str_loadlib
}