From 2d10ec7803f166b7f67a9bec355b367ededc4b5f Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Thu, 25 Feb 2016 19:19:05 +0100
Subject: [PATCH] Update LimaDelta.yara

---
 malware/Operation_Blockbuster/LimaDelta.yara | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/malware/Operation_Blockbuster/LimaDelta.yara b/malware/Operation_Blockbuster/LimaDelta.yara
index d9416e3..0d79d59 100644
--- a/malware/Operation_Blockbuster/LimaDelta.yara
+++ b/malware/Operation_Blockbuster/LimaDelta.yara
@@ -39,21 +39,7 @@ rule LimaDelta
 		83 C3 46                       add     ebx, 46h
 	*/
 
-	$authenicateBufferGen = {
-			BB 01 
-			74 ??
-			FF 15 [4]
-			99 
-			B? 32 00 00 00 
-			F7 ?? 
-			8B ?? 
-			8D [3]
-			5? 
-			5? 
-			E8 [4]
-			83 C4 08 
-			83 ?? 46 
-		}
+	$authenicateBufferGen = {BB 01 74 ?? FF 15 [4] 99 B? 32 00 00 00 F7 ?? 8B ?? 8D [3] 5? 5? E8 [4] 83 C4 08 83 ?? 46}
 	
 	condition:
 		$authenicateBufferGen in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))