Recommended changes to YARA rule

[Neo23x0]

Important changes:

• 2 condition bugs
• Regex using .*

Optional changes:

• Regex split up to strings

[Neo23x0]

Further explanations:

($oep at pe.entry_point or $oep)

^ this part of the condition is just as saying $oep

or (any of ($s*) and any of ($r*)) 
          or any of ($r*)

^ this is just the same logic error. It's basically as if you would say

a and b or b 

[Neo23x0]

Regex issue

The regex contains .*, which is discouraged for performance reasons. Many YARA versions printed a warning that this slows down scanning ... because it really does. It's a major performance issue. You should try to avoid using a regex at all or at least reduce it to a range .{1,X}.

See https://github.com/Neo23x0/YARA-Performance-Guidelines/#regular-expressions

[chvancooten]

Thanks for the modifications and explanation, will be included for v1.1!