fix: variable in condition

phantinuss · Oct 23, 2023 · 6dfaa49 · 6dfaa49
1 parent 5b34a20
commit 6dfaa49
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/yara/gen_mal_scripts.yar b/yara/gen_mal_scripts.yar
@@ -82,8 +82,8 @@ rule Certutil_Decode_OR_Download {
 
       $fp_msi = { 52 00 6F 00 6F 00 74 00 20 00 45 00 6E 00 74 00 72 00 79 }
    condition:
-      filesize < 700KB 
-      and 1 of (a*)
+      filesize < 700KB
+      and 1 of ($a*)
       and not 1 of ($fp*)
 }