Disable PEiD Armadillo packer false positive (#4)

"Armadillo v1.xx - v2.xx" is a false positive https://www.zscaler.com/blogs/research/your-windows-8-packed
malice-plugins · Sep 8, 2019 · ed703fb · ed703fb
1 parent 7fd993b
commit ed703fb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/rules/peid-userdb-rules-with-pe-module.yara b/rules/peid-userdb-rules-with-pe-module.yara
@@ -1685,6 +1685,7 @@ rule PEiD_00152_Armadillo_v1_9x_
         $a at pe.entry_point
 }
 
+/* false positive - https://www.zscaler.com/blogs/research/your-windows-8-packed
 rule PEiD_00153_Armadillo_v1_xx___v2_xx_
 {
     meta:
@@ -1695,6 +1696,7 @@ rule PEiD_00153_Armadillo_v1_xx___v2_xx_
     condition:
         $a at pe.entry_point
 }
+*/
 
 rule PEiD_00154_Armadillo_v2_00_
 {

diff --git a/rules/userdb_panda.yar b/rules/userdb_panda.yar
@@ -9746,6 +9746,7 @@ rule _PENightMare_v13_
 		$0 at entrypoint
 }
 
+/* false positive - https://www.zscaler.com/blogs/research/your-windows-8-packed
 rule _Armadillo_v1xx__v2xx_
 {
 	meta:
@@ -9755,6 +9756,7 @@ rule _Armadillo_v1xx__v2xx_
 	condition:
 		$0 at entrypoint
 }
+*/
 
 rule _WATCOM_CCpp_32_RunTime_System_19881995_
 {