Skip to content

Commit c556c00

Browse files
committed
Add VPacker, RLPack, and TheArk packer signatures
Added VPacker and RLPack to the hash-based packer detection list and TheArk to the section name-based detection list. Also removed a duplicate VPacker entry from the hash-based cryptor detection array.
1 parent eb7aac8 commit c556c00

File tree

1 file changed

+5
-3
lines changed

1 file changed

+5
-3
lines changed

db/PE/__GenericHeuristicAnalysis_By_DosX.7.sg

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2097,6 +2097,8 @@ function scanForPackersAndCryptors_NET_and_Native() { // For .NET and Native app
20972097
["CExe", "1.0a", 0, 0xdcf764d2, 0],
20982098
["PE-PACK", "1.0", 0, 0xa4d96677, 0],
20992099
["BoxedApp", null, 0, 0x6206c0c2, 0],
2100+
["VPacker", "0.02.X", 0, 0xebc3bc90, 0],
2101+
["RLPack", "1.16+", 0, 0x6889715b, 0],
21002102
// cryptors
21012103
["Yoda's Crypter", "1.X", -1, 0x1303a51b, 1],
21022104
["EXECryptor", "1.4-1.5", -1, 0xd1de53b5, 1],
@@ -2140,8 +2142,7 @@ function scanForPackersAndCryptors_NET_and_Native() { // For .NET and Native app
21402142
["CodeVirtualizer", null, 4, 0x4fbeea23, 2], // https://www.oreans.com/CodeVirtualizer.php
21412143
["PELock", null, 0, [0x6eb8f6f1, 0xe571f715], 2],
21422144
["CrypToCrack", "0.9.X", 0, 0x8b28bb4e, 2],
2143-
["DBPE", null, 0, [0x301ad755, 0x33406ae3], 2],
2144-
["VPacker", "0.02.X", 0, 0xebc3bc90, 2]
2145+
["DBPE", null, 0, [0x301ad755, 0x33406ae3], 2]
21452146
];
21462147

21472148
const importValidatingResult = validateImportHashes(dbCollectionOfHashesDict);
@@ -2277,7 +2278,8 @@ function scanForPackersAndCryptors_NET_and_Native() { // For .NET and Native app
22772278
["DragonArmor", "0.0.4.1", "DAStub"],
22782279
["EXECrypt", "1.0", "CRPT"],
22792280
["N-Code", "0.2", [".pepsi", "n-coded", ".vrs"]],
2280-
["NoodleCrypt", "2.X", [".Ncryo ", ".De-vir "]]
2281+
["NoodleCrypt", "2.X", [".Ncryo ", ".De-vir "]],
2282+
["TheArk", null, ["30cm", ".tw"]]
22812283
];
22822284

22832285
const sectionNamesValidatingResult = validateSectionNames(dbCollectionOfSectionNamesDict.concat(

0 commit comments

Comments
 (0)