Re: Yara rule: how to detect unsupported PE file for Windows 10?

2021-03-09 Thread Wesley Shields
The string you are highlighting is not indicative of a file running on Windows 10 or not. That string is in the DOS stub, which is executed when you try to run the program under DOS. Why this particular file is not running on your system is a different issue but it has nothing to do with that

Yara rule: how to detect unsupported PE file for Windows 10?

2021-03-09 Thread Unknown
I wonder is exist a rule for detecting damage, corrupted, unsupported binary file by Windows Loader? Sometimes a file can not be executed on Windows. [image: app.png] Sometimes a file can not be run on Windows 10: [image: app2.png] How do you think it can be done by Yara rule to detect such