From 8da4b62ba93320bc48dec22aa9be3d54bdab04da Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Thu, 25 Feb 2016 19:19:37 +0100
Subject: [PATCH] Update IndiaDelta.yara

---
 malware/Operation_Blockbuster/IndiaDelta.yara | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/malware/Operation_Blockbuster/IndiaDelta.yara b/malware/Operation_Blockbuster/IndiaDelta.yara
index c49a241..7d611e3 100644
--- a/malware/Operation_Blockbuster/IndiaDelta.yara
+++ b/malware/Operation_Blockbuster/IndiaDelta.yara
@@ -23,14 +23,7 @@ rule IndiaDelta
 		FF 15 E0 2D 41 00  call    SetFilePointer_0
 	*/
 
-	$a =   { 
-			FF 15 [4-12] 
-			3? 78 56 34 12 
-			[0-2] 
-			8? ?? 78 56 34 12 
-			[0-10]
-			FF 15
-   		}
+	$a =   {FF 15 [4-12] 3? 78 56 34 12 [0-2] 8? ?? 78 56 34 12 [0-10] FF 15}
 
 	condition:
 		$a in ((pe.sections[pe.section_index(".text")].raw_data_offset)..(pe.sections[pe.section_index(".text")].raw_data_offset + pe.sections[pe.section_index(".text")].raw_data_size))