Yara Rule for CVE-2010-1885

Posted: June 11th, 2010 | Author: xanda | Filed under: IT Related | Tags: CVE-2010-1885, jsunpack, Windows Help and Support Center, yara | 3 Comments »

rule HelpSupportCenter
{
   meta:  
      ref = "CVE-2010-1885"
      hide = true
      impact = 5 
   strings:
      $cve20101885 = /hcp:\/\/.*?(%u?[A-F]{1,4}.*?){90}/
   condition:
       all of them
}