If one were to manually fetch the latest Security Intelligence Update (i.e.e https://go.microsoft.com/fwlink/?LinkID=121721&arch=x64 for x64) using a tool that allows seeing the contents of an executable file (such as 7zFM), there are 4 large files with a .vdm extension (mpasbase.vdm, mpasdlta.vdm, mpavbase.vdm, and mpavdlta.vdm). I presume that's where the definitions and malware signatures reside.
Is there an existing program that can extract these files?
BONUS: is there a program that can convert them to YARA files as well?
[link] [comments]
from hacking: security in practice https://ift.tt/BD21ULw
Comments
Post a Comment