Fix #420

Yara-Rules · Oct 8, 2021 · 56c5e06 · 56c5e06
2 parents d1851b6 + 09d6f65
commit 56c5e06
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/maldocs/Maldoc_CVE_2017_11882.yar b/maldocs/Maldoc_CVE_2017_11882.yar
@@ -9,10 +9,11 @@ rule Maldoc_CVE_2017_11882 : Exploit {
         reference = "c63ccc5c08c3863d7eb330b69f96c1bcf1e031201721754132a4c4d0baff36f8"
         date = "2017-10-20"
     strings:
+        $doc = "d0cf11e0a1b11ae1"
         $s0 = "Equation"
         $s1 = "1c000000020"
         $h0 = {1C 00 00 00 02 00}
 
     condition: 
-        $s0 and ($h0 or $s1)
+        (uint32be(0) == 0x7B5C7274 or $doc at 0 ) and $s0 and ($h0 or $s1)
 }