Is this RSA algorithm?

[bridgeic]

Originally Posted by Storm Shadow

if you do a yara scan
you will quickly see if the scanner is set proberly.

you will see the yara rules load after push button peform yara scan
RL]

I'm sorry I didn't notice there is a push button, yes, I see the yara rules loaded when push the button, thank you so much.

Originally Posted by Storm Shadow

he adds the RSA headers to the scanner

rules = yara.compile(sources = {  
  'x509' : 'rule x509 {strings: $a = {30 82 ?? ?? 30 82 ?? ??} condition: $a}',
  'pkcs' : 'rule pkcs {strings: $a = {30 82 ?? ?? 02 01 00} condition: $a}',
  })

Which file I should put this rule into? I try name a new rule file as rsa.yar, but seems failed to load.