rule Exploit_WinNT_GetClass_A{
meta:
description = "Exploit:WinNT/GetClass.A,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
strings :
$a_01_0 = {19 04 32 19 03 32 2a b6 2d 2c b8 2a b6 2d 2c b8 a7 } //1
condition:
((#a_01_0 & 1)*1) >=1
}