Antidebug Api And Timing Check Combination
Detects binaries importing both IsDebuggerPresent and CheckRemoteDebuggerPresent combined with anti-debug timing-check code patterns (rdtsc instruction and/or GetTickCount/QueryPerformanceCounter timing APIs), requiring multiple corroborating indicators to reduce false positives on legitimate software. Excludes binaries carrying a verified digital signature to avoid flagging legitimately signed software using these APIs for license-protection or anti-tamper purposes.
YARA
