Crafting Yara Signatures from Code using Hex - Detecting PECompact2

In this video, we'll take a look at how to create Yara rules using code patterns, that is byte sequences, from IDA Pro. We'll use a sample packed with PECompact2, which is a commonly used packer for malware. We'll identify code pattern to use for the signature, discuss platforms to help validate our rule, and then test our rule against representative samples.

00:16 Why PE?
1:01 Sample on VirusTotal
1:26 My approach to this analysis
2:49 Yaraify project on Abuse.ch …

code discuss hex ida ida pro identify malware packer patterns platforms pro rules sample signature signatures video yara yara rules