Skip to content

Instantly share code, notes, and snippets.

@tlansec

tlansec/pe_check.yar

Created January 6, 2022 10:33
Show Gist options
  • Save tlansec/4be4e92cbbd3354cf53386ef6edf0676 to your computer and use it in GitHub Desktop.
Save tlansec/4be4e92cbbd3354cf53386ef6edf0676 to your computer and use it in GitHub Desktop.
Download ZIP
Use with -D flag to dump PE metadata about a file, I have an alias of "pe_yara=yara -D $*" so I can just run "pe_yara -D foo.bin"
Raw
pe_check.yar
import "pe"
rule always_false
{
condition:
false
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment