diff --git a/malware/Operation_Blockbuster/IndiaDelta.yara b/malware/Operation_Blockbuster/IndiaDelta.yara index c49a241..7d611e3 100644 --- a/malware/Operation_Blockbuster/IndiaDelta.yara +++ b/malware/Operation_Blockbuster/IndiaDelta.yara @@ -23,14 +23,7 @@ rule IndiaDelta FF 15 E0 2D 41 00 call SetFilePointer_0 */ - $a = { - FF 15 [4-12] - 3? 78 56 34 12 - [0-2] - 8? ?? 78 56 34 12 - [0-10] - FF 15 - } + $a = {FF 15 [4-12] 3? 78 56 34 12 [0-2] 8? ?? 78 56 34 12 [0-10] FF 15} condition: $a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))