Rule Info
Name
SUSP_PE_PARSING_Aug26
Author
Pezier Pierre-Henri
Description
Detects PE parsing, which is often used in shellcode and malware to locate modules via the PEB
Score
70
Date
2026-08-24
Minimum Yara
3.5.0
Rule Hash
ede6bef52bf561b69b694547799fd822
Tags
['EXE', 'SUSP', 'FILE']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
8
Clean (0 engines)
2
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR