From 09d6f650867f708c13d3463264d8be9c8080e3f9 Mon Sep 17 00:00:00 2001
From: Bondey <marc.safe@protonmail.com>
Date: Fri, 8 Oct 2021 14:31:22 +0200
Subject: [PATCH] Update Maldoc_CVE_2017_11882.yar

now it only detects documents
---
 Malicious_Documents/Maldoc_CVE_2017_11882.yar | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/Malicious_Documents/Maldoc_CVE_2017_11882.yar b/Malicious_Documents/Maldoc_CVE_2017_11882.yar
index 7980664..293fc86 100644
--- a/Malicious_Documents/Maldoc_CVE_2017_11882.yar
+++ b/Malicious_Documents/Maldoc_CVE_2017_11882.yar
@@ -5,10 +5,11 @@ rule Maldoc_CVE_2017_11882 : Exploit {
         reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8"
         date = "2017-10-20"
     strings:
+        $doc = "d0cf11e0a1b11ae1"
         $s0 = "Equation"
         $s1 = "1c000000020"
         $h0 = {1C 00 00 00 02 00}
 
     condition: 
-        $s0 and ($h0 or $s1)
+        (uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)
 }