mirror of
https://github.com/mandiant/capa-rules
synced 2026-06-08 15:41:20 +00:00
Yacine Elhamer
24 lines
687 B
YAML
24 lines
687 B
YAML
rule:
|
||
meta:
|
||
name: compiled from EPL
|
||
namespace: compiler/epl
|
||
authors:
|
||
- william.ballenthin@mandiant.com
|
||
scopes:
|
||
static: file
|
||
dynamic: file
|
||
references:
|
||
- https://www.hexacorn.com/blog/2019/02/13/pe-files-and-the-easy-programming-language-epl/
|
||
features:
|
||
- or:
|
||
- string: "GetNewSock"
|
||
- string: "Software\\FlySky\\E\\Install"
|
||
- string: "Not found the kernel library or the kernel library is invalid!"
|
||
- string: "Failed to allocate memory!"
|
||
- string: "/ MADE BY E COMPILER – WUTAO"
|
||
- section: .ecode
|
||
- import: krnln.fne
|
||
- import: krnln.fnr
|
||
- import: eAPI.fne
|
||
- import: RegEx.fnr
|