Exe_Cloaked_as_ThumbsDb

Description

Detects an executable cloaked as thumbs.db - Malware

Query · yara

condition:
      uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
Raw source Exe_Cloaked_as_ThumbsDb · YARA
Esc
Published by Neo23x0/signature-base ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
rule Exe_Cloaked_as_ThumbsDb {
   meta:
      description = "Detects an executable cloaked as thumbs.db - Malware"
      date = "2014-07-18"
      license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
      author = "Florian Roth (Nextron Systems)"
      score = 50
      id = "ff09f8cf-de5a-50fc-aa0b-c54f7667e246"
   condition:
      uint16(0) == 0x5a4d and filename matches /[Tt]humbs\.db/
}

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.