VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.26k stars 1.44k forks source link

.NET resource content parsing #1894

Open djlukic opened 1 year ago

djlukic commented 1 year ago

Hi,

I was looking into this https://yara.readthedocs.io/en/stable/modules/dotnet.html and my question is, is it possible to parse the content of .NET resource? It would be handy to target some malware related string in the resource, base64 encoded string etc.