rule:
meta:
name: (internal) Visual Basic file limitation
namespace: internal/limitation/file
authors:
- "@mr-tz"
description: |
This sample appears to be compiled from Visual Basic.
Visual Basic is a Microsoft programming language that can be compiled to native code or an intermediate
representation called P-Code.
capa cannot handle Visual Basic executables well. This means that the results will be misleading or incomplete.
You may have to analyze the file manually, for example using a tool like VB Decompiler.
scopes:
static: file
dynamic: file
examples:
- 9bca6b99e7981208af4c7925b96fb9cf
features:
- or:
- match: compiler/vb
last edited: 2023-11-24 10:34:28