Volatility3 MCP Server

/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ rule FlashNewfunction: decodedPDF { meta: ref = "CVE-2010-1297" hide = true impact = 5 ref = "http://blog.xanda.org/tag/jsunpack/" strings: $unescape = "unescape" fullword nocase $shellcode = /%u[A-Fa-f0-9]{4}/ $shellcode5 = /(%u[A-Fa-f0-9]{4}){5}/ $cve20101297 = /\/Subtype ?\/Flash/ condition: ($unescape and $shellcode and $cve20101297) or ($shellcode5 and $cve20101297) }