rule win_vobfus_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.vobfus." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vobfus" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b5508 8b92e8000000 8b82f4010000 50 50 8b10 } // n = 6, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b82f4010000 | mov eax, dword ptr [edx + 0x1f4] // 50 | push eax // 50 | push eax // 8b10 | mov edx, dword ptr [eax] $sequence_1 = { 8b5508 8b92e8000000 8b82c8030000 50 } // n = 4, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b82c8030000 | mov eax, dword ptr [edx + 0x3c8] // 50 | push eax $sequence_2 = { 8b5508 8b92e8000000 8b8274210000 50 } // n = 4, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b8274210000 | mov eax, dword ptr [edx + 0x2174] // 50 | push eax $sequence_3 = { 8b5508 8b92e8000000 8b824c220000 50 } // n = 4, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b824c220000 | mov eax, dword ptr [edx + 0x224c] // 50 | push eax $sequence_4 = { 8b5508 8b92e8000000 8b82e4170000 50 } // n = 4, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b82e4170000 | mov eax, dword ptr [edx + 0x17e4] // 50 | push eax $sequence_5 = { 55 8bec 8b5508 8b92e8000000 8b824c070000 50 } // n = 6, score = 200 // 55 | push ebp // 8bec | mov ebp, esp // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b824c070000 | mov eax, dword ptr [edx + 0x74c] // 50 | push eax $sequence_6 = { 8b5508 8b92e8000000 8b8278050000 50 } // n = 4, score = 200 // 8b5508 | mov edx, dword ptr [ebp + 8] // 8b92e8000000 | mov edx, dword ptr [edx + 0xe8] // 8b8278050000 | mov eax, dword ptr [edx + 0x578] // 50 | push eax $sequence_7 = { 8b82101f0000 50 50 8b10 ff5204 58 } // n = 6, score = 200 // // 50 | push eax // 50 | push eax // 8b10 | mov edx, dword ptr [eax] // ff5204 | call dword ptr [edx + 4] // 58 | pop eax $sequence_8 = { 46 14ff 0470 fe0a } // n = 4, score = 100 // 46 | inc esi // 14ff | adc al, 0xff // 0470 | add al, 0x70 // fe0a | dec byte ptr [edx] $sequence_9 = { 8f00 e3ce 97 00e6 d39500e4d19b 00cf c0b200d1c3b600 } // n = 7, score = 100 // 8f00 | pop dword ptr [eax] // e3ce | jecxz 0xffffffd0 // 97 | xchg eax, edi // 00e6 | add dh, ah // d39500e4d19b | rcl dword ptr [ebp - 0x642e1c00], cl // 00cf | add bh, cl // c0b200d1c3b600 | sal byte ptr [edx - 0x493c2f00], 0 $sequence_10 = { f2ed ec f3ed ebf2 } // n = 4, score = 100 // f2ed | in eax, dx // ec | in al, dx // f3ed | in eax, dx // ebf2 | jmp 0xfffffff4 $sequence_11 = { ff06 0200 0100 8a00 0010 4c 0007 } // n = 7, score = 100 // ff06 | inc dword ptr [esi] // 0200 | add al, byte ptr [eax] // 0100 | add dword ptr [eax], eax // 8a00 | mov al, byte ptr [eax] // 0010 | add byte ptr [eax], dl // 4c | dec esp // 0007 | add byte ptr [edi], al $sequence_12 = { 0100 6c 74ff 801800 } // n = 4, score = 100 // 0100 | add dword ptr [eax], eax // 6c | insb byte ptr es:[edi], dx // 74ff | je 1 // 801800 | sbb byte ptr [eax], 0 $sequence_13 = { d39500e4d19b 00cf c0b200d1c3b600 e6d3 a1???????? 00ec } // n = 6, score = 100 // d39500e4d19b | rcl dword ptr [ebp - 0x642e1c00], cl // 00cf | add bh, cl // c0b200d1c3b600 | sal byte ptr [edx - 0x493c2f00], 0 // e6d3 | out 0xd3, al // a1???????? | // 00ec | add ah, ch $sequence_14 = { 0d50004900 3e3cff 46 14ff } // n = 4, score = 100 // 0d50004900 | or eax, 0x490050 // 3e3cff | cmp al, 0xff // 46 | inc esi // 14ff | adc al, 0xff $sequence_15 = { 0006 3401 41 06 1005???????? 0100 6c } // n = 7, score = 100 // 0006 | add byte ptr [esi], al // 3401 | xor al, 1 // 41 | inc ecx // 06 | push es // 1005???????? | // 0100 | add dword ptr [eax], eax // 6c | insb byte ptr es:[edi], dx $sequence_16 = { ec f2ed ec f2ed ec } // n = 5, score = 100 // ec | in al, dx // f2ed | in eax, dx // ec | in al, dx // f2ed | in eax, dx // ec | in al, dx $sequence_17 = { 1400 48 0008 78ff 0d50004900 3e3cff } // n = 6, score = 100 // 1400 | adc al, 0 // 48 | dec eax // 0008 | add byte ptr [eax], cl // 78ff | js 1 // 0d50004900 | or eax, 0x490050 // 3e3cff | cmp al, 0xff $sequence_18 = { d2b5f2bb8ff3 ae 73f3 aa 5c f6ac4ff8b54ffb c058fcca } // n = 7, score = 100 // d2b5f2bb8ff3 | sal byte ptr [ebp - 0xc70440e], cl // ae | scasb al, byte ptr es:[edi] // 73f3 | jae 0xfffffff5 // aa | stosb byte ptr es:[edi], al // 5c | pop esp // f6ac4ff8b54ffb | imul byte ptr [edi + ecx*2 - 0x4b04a08] // c058fcca | rcr byte ptr [eax - 4], 0xca $sequence_19 = { f3ed ebf2 ed ec } // n = 4, score = 100 // f3ed | in eax, dx // ebf2 | jmp 0xfffffff4 // ed | in eax, dx // ec | in al, dx $sequence_20 = { 7cc8 dc7acd e291 d2e8 } // n = 4, score = 100 // 7cc8 | jl 0xffffffca // dc7acd | fdivr qword ptr [edx - 0x33] // e291 | loop 0xffffff93 // d2e8 | shr al, cl $sequence_21 = { 00d5 c19400d6c49500d7 c59900dac999 00e0 c9 } // n = 5, score = 100 // 00d5 | add ch, dl // c19400d6c49500d7 | rcl dword ptr [eax + eax + 0x95c4d6], 0xd7 // c59900dac999 | lds ebx, ptr [ecx - 0x66362600] // 00e0 | add al, ah // c9 | leave $sequence_22 = { 41 06 1001 ff06 0200 0100 } // n = 6, score = 100 // 41 | inc ecx // 06 | push es // 1001 | adc byte ptr [ecx], al // ff06 | inc dword ptr [esi] // 0200 | add al, byte ptr [eax] // 0100 | add dword ptr [eax], eax $sequence_23 = { bdb000d6c2 91 00d5 c19400d6c49500d7 } // n = 4, score = 100 // bdb000d6c2 | mov ebp, 0xc2d600b0 // 91 | xchg eax, ecx // 00d5 | add ch, dl // c19400d6c49500d7 | rcl dword ptr [eax + eax + 0x95c4d6], 0xd7 condition: 7 of them and filesize < 409600 }