The string you are highlighting is not indicative of a file running on Windows 10 or not. That string is in the DOS stub, which is executed when you try to run the program under DOS. Why this particular file is not running on your system is a different issue but it has nothing to do with that string. In fact, that particular string is common across all delphi language executables. One option to detect it is to share a hash of the file so people can inspect it and see what is really going on.
-- WXS > On Mar 9, 2021, at 7:36 AM, Unknown <ad.sci...@gmail.com> wrote: > > I wonder is exist a rule for detecting damage, corrupted, unsupported binary > file by Windows Loader? > > Sometimes a file can not be executed on Windows. > > <app.png> > > Sometimes a file can not be run on Windows 10: > > <app2.png> > > How do you think it can be done by Yara rule to detect such of broken, > unsupported files? > > > -- > You received this message because you are subscribed to the Google Groups > "YARA" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yara-project+unsubscr...@googlegroups.com > <mailto:yara-project+unsubscr...@googlegroups.com>. > To view this discussion on the web visit > https://groups.google.com/d/msgid/yara-project/50d502d1-fae2-4e89-bca1-9309a85e103fn%40googlegroups.com > > <https://groups.google.com/d/msgid/yara-project/50d502d1-fae2-4e89-bca1-9309a85e103fn%40googlegroups.com?utm_medium=email&utm_source=footer>. > <app2.png><app.png> -- You received this message because you are subscribed to the Google Groups "YARA" group. To unsubscribe from this group and stop receiving emails from it, send an email to yara-project+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/yara-project/4CD98139-8B8A-484E-B1A0-B6FC7217A3F5%40gmail.com.
