http://courses.cs.taltech.ee/w/index.php?action=history&feed=atom&title=Malware%3AITX8060%3A2014%3ALAB3 2026-05-21T21:06:54Z Selle lehekülje redigeerimiste ajalugu MediaWiki 1.35.9 http://courses.cs.taltech.ee/w/index.php?title=Malware:ITX8060:2014:LAB3&diff=1185&oldid=prev 2014-12-16T14:34:44Z

<p></p> <table class="diff diff-contentalign-left diff-editfont-monospace" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="et"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">←Vanem redaktsioon</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Redaktsioon: 16. detsember 2014, kell 14:34</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l2" >2. rida:</td> <td colspan="2" class="diff-lineno">2. rida:</td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>=== <del class="diffchange diffchange-inline">Make : </del>Yara rule ===</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>=== Yara rule ===</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Yara rule <del class="diffchange diffchange-inline">should  find the </del>files <del class="diffchange diffchange-inline">YOU examined for </del>[<del class="diffchange diffchange-inline">[Malware:ITX8042:2014:LAB3 | Malware1</del>:<del class="diffchange diffchange-inline">Lab3 ]</del>]</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Createa </ins>Yara rule <ins class="diffchange diffchange-inline">that takes your student code as a parameter and finds two </ins>files <ins class="diffchange diffchange-inline">from </ins>[<ins class="diffchange diffchange-inline">https</ins>:<ins class="diffchange diffchange-inline">//sim.cert.ee/hw/pahadus.zip Pahadus.zip</ins>]  </div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">from </del>[<del class="diffchange diffchange-inline">https</del>:<del class="diffchange diffchange-inline">//sim.cert.ee/hw/pahadus.zip Pahadus.zip</del>] <del class="diffchange diffchange-inline">when your student number is given as a parameter</del>.</div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">(files found should be the ones you used for  </ins>[<ins class="diffchange diffchange-inline">[Malware</ins>:<ins class="diffchange diffchange-inline">ITX8042:2014:LAB3 | Malware1:Lab3 ]</ins>]<ins class="diffchange diffchange-inline">)</ins>.</div></td></tr> <tr><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td><td class='diff-marker'> </td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"></td></tr> <tr><td class='diff-marker'>−</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline">Rule should work allsow in situation where File name is </del>changed <del class="diffchange diffchange-inline">!</del></div></td><td class='diff-marker'>+</td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">The names of the files can be </ins>changed <ins class="diffchange diffchange-inline">(so use something else for their identification)</ins></div></td></tr> </table>

Toomas http://courses.cs.taltech.ee/w/index.php?title=Malware:ITX8060:2014:LAB3&diff=1171&oldid=prev 2014-12-15T15:26:44Z

<p>Uus lehekülg: &#039;== LAB3 == === Make : Yara rule === Yara rule should find the files YOU examined for <a href="/pages/Malware:ITX8042:2014:LAB3" title="Malware:ITX8042:2014:LAB3"> Malware1:Lab3 </a> from [https://sim.cert.ee/hw/pahadus.zip...&#039;</p> <p><b>Uus lehekülg</b></p><div>== LAB3 ==<br /> <br /> <br /> === Make : Yara rule ===<br /> <br /> <br /> Yara rule should find the files YOU examined for [[Malware:ITX8042:2014:LAB3 | Malware1:Lab3 ]]<br /> <br /> from [https://sim.cert.ee/hw/pahadus.zip Pahadus.zip] when your student number is given as a parameter.<br /> <br /> Rule should work allsow in situation where File name is changed !</div>

Toomas