There is no description at this point.
rule win_beepservice_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.beepservice." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.beepservice" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 68???????? ffd6 8bc8 ff15???????? 50 ff15???????? } // n = 6, score = 600 // 68???????? | // ffd6 | call esi // 8bc8 | mov ecx, eax // ff15???????? | // 50 | push eax // ff15???????? | $sequence_1 = { 683f000f00 6a00 68???????? ff15???????? } // n = 4, score = 500 // 683f000f00 | push 0xf003f // 6a00 | push 0 // 68???????? | // ff15???????? | $sequence_2 = { 83f801 7505 e8???????? 68???????? 68???????? } // n = 5, score = 500 // 83f801 | cmp eax, 1 // 7505 | jne 7 // e8???????? | // 68???????? | // 68???????? | $sequence_3 = { ff15???????? 50 68???????? e8???????? 83c408 e9???????? 68???????? } // n = 7, score = 500 // ff15???????? | // 50 | push eax // 68???????? | // e8???????? | // 83c408 | add esp, 8 // e9???????? | // 68???????? | $sequence_4 = { 83c408 e9???????? 68???????? e8???????? 83c404 6a00 } // n = 6, score = 500 // 83c408 | add esp, 8 // e9???????? | // 68???????? | // e8???????? | // 83c404 | add esp, 4 // 6a00 | push 0 $sequence_5 = { 7512 6888130000 68???????? e8???????? } // n = 4, score = 500 // 7512 | jne 0x14 // 6888130000 | push 0x1388 // 68???????? | // e8???????? | $sequence_6 = { e8???????? 59 59 ff761c e8???????? 83f820 } // n = 6, score = 400 // e8???????? | // 59 | pop ecx // 59 | pop ecx // ff761c | push dword ptr [esi + 0x1c] // e8???????? | // 83f820 | cmp eax, 0x20 $sequence_7 = { ff7608 e8???????? 50 ff7608 68???????? e8???????? 83c444 } // n = 7, score = 400 // ff7608 | push dword ptr [esi + 8] // e8???????? | // 50 | push eax // ff7608 | push dword ptr [esi + 8] // 68???????? | // e8???????? | // 83c444 | add esp, 0x44 $sequence_8 = { 750e ff15???????? 50 68???????? eb43 56 8d45fc } // n = 7, score = 400 // 750e | jne 0x10 // ff15???????? | // 50 | push eax // 68???????? | // eb43 | jmp 0x45 // 56 | push esi // 8d45fc | lea eax, [ebp - 4] $sequence_9 = { 83f820 59 730f ff7618 68???????? } // n = 5, score = 400 // 83f820 | cmp eax, 0x20 // 59 | pop ecx // 730f | jae 0x11 // ff7618 | push dword ptr [esi + 0x18] // 68???????? | $sequence_10 = { 50 ff15???????? 83c410 33f6 8d85fcfdffff 56 56 } // n = 7, score = 400 // 50 | push eax // ff15???????? | // 83c410 | add esp, 0x10 // 33f6 | xor esi, esi // 8d85fcfdffff | lea eax, [ebp - 0x204] // 56 | push esi // 56 | push esi $sequence_11 = { e8???????? ff7610 e8???????? 50 } // n = 4, score = 400 // e8???????? | // ff7610 | push dword ptr [esi + 0x10] // e8???????? | // 50 | push eax $sequence_12 = { e8???????? 50 ff7614 57 e8???????? 83c42c e8???????? } // n = 7, score = 400 // e8???????? | // 50 | push eax // ff7614 | push dword ptr [esi + 0x14] // 57 | push edi // e8???????? | // 83c42c | add esp, 0x2c // e8???????? | $sequence_13 = { f3a4 8b531c 83c9ff 8bfa 33c0 f2ae } // n = 6, score = 300 // f3a4 | rep movsb byte ptr es:[edi], byte ptr [esi] // 8b531c | mov edx, dword ptr [ebx + 0x1c] // 83c9ff | or ecx, 0xffffffff // 8bfa | mov edi, edx // 33c0 | xor eax, eax // f2ae | repne scasb al, byte ptr es:[edi] $sequence_14 = { a3???????? 83c404 a3???????? a3???????? 66a3???????? f3ab b908000000 } // n = 7, score = 300 // a3???????? | // 83c404 | add esp, 4 // a3???????? | // a3???????? | // 66a3???????? | // f3ab | rep stosd dword ptr es:[edi], eax // b908000000 | mov ecx, 8 $sequence_15 = { 49 83f920 7320 8bfa 83c9ff } // n = 5, score = 300 // 49 | dec ecx // 83f920 | cmp ecx, 0x20 // 7320 | jae 0x22 // 8bfa | mov edi, edx // 83c9ff | or ecx, 0xffffffff $sequence_16 = { ffd7 8d442414 50 56 } // n = 4, score = 300 // ffd7 | call edi // 8d442414 | lea eax, [esp + 0x14] // 50 | push eax // 56 | push esi $sequence_17 = { ff15???????? 8985d4fdffff 83bdd4fdffff00 7516 ff15???????? 50 68???????? } // n = 7, score = 200 // ff15???????? | // 8985d4fdffff | mov dword ptr [ebp - 0x22c], eax // 83bdd4fdffff00 | cmp dword ptr [ebp - 0x22c], 0 // 7516 | jne 0x18 // ff15???????? | // 50 | push eax // 68???????? | $sequence_18 = { eb0f 8b95f8fdffff 83c201 8995f8fdffff 83bdf8fdffff0a } // n = 5, score = 200 // eb0f | jmp 0x11 // 8b95f8fdffff | mov edx, dword ptr [ebp - 0x208] // 83c201 | add edx, 1 // 8995f8fdffff | mov dword ptr [ebp - 0x208], edx // 83bdf8fdffff0a | cmp dword ptr [ebp - 0x208], 0xa $sequence_19 = { e9???????? 8b550c 8b4210 50 e8???????? 83c404 83f826 } // n = 7, score = 200 // e9???????? | // 8b550c | mov edx, dword ptr [ebp + 0xc] // 8b4210 | mov eax, dword ptr [edx + 0x10] // 50 | push eax // e8???????? | // 83c404 | add esp, 4 // 83f826 | cmp eax, 0x26 $sequence_20 = { 81c428010000 c3 5f 5e 33c0 5b } // n = 6, score = 100 // 81c428010000 | add esp, 0x128 // c3 | ret // 5f | pop edi // 5e | pop esi // 33c0 | xor eax, eax // 5b | pop ebx $sequence_21 = { 7ced b90a000000 be???????? bf???????? 33c0 } // n = 5, score = 100 // 7ced | jl 0xffffffef // b90a000000 | mov ecx, 0xa // be???????? | // bf???????? | // 33c0 | xor eax, eax $sequence_22 = { 7403 50 ffd6 a1???????? 85c0 7415 } // n = 6, score = 100 // 7403 | je 5 // 50 | push eax // ffd6 | call esi // a1???????? | // 85c0 | test eax, eax // 7415 | je 0x17 $sequence_23 = { 6a00 6a00 51 e8???????? 83c414 c3 } // n = 6, score = 100 // 6a00 | push 0 // 6a00 | push 0 // 51 | push ecx // e8???????? | // 83c414 | add esp, 0x14 // c3 | ret $sequence_24 = { 8b45e4 85c0 7407 50 ff15???????? 85ff } // n = 6, score = 100 // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 85c0 | test eax, eax // 7407 | je 9 // 50 | push eax // ff15???????? | // 85ff | test edi, edi $sequence_25 = { 6a01 e8???????? 83c414 a1???????? 85c0 7403 50 } // n = 7, score = 100 // 6a01 | push 1 // e8???????? | // 83c414 | add esp, 0x14 // a1???????? | // 85c0 | test eax, eax // 7403 | je 5 // 50 | push eax $sequence_26 = { 6a00 6a00 57 ff15???????? 8945e4 85c0 } // n = 6, score = 100 // 6a00 | push 0 // 6a00 | push 0 // 57 | push edi // ff15???????? | // 8945e4 | mov dword ptr [ebp - 0x1c], eax // 85c0 | test eax, eax $sequence_27 = { 8a8228304000 3c39 7f04 3c30 7d02 32db } // n = 6, score = 100 // 8a8228304000 | mov al, byte ptr [edx + 0x403028] // 3c39 | cmp al, 0x39 // 7f04 | jg 6 // 3c30 | cmp al, 0x30 // 7d02 | jge 4 // 32db | xor bl, bl condition: 7 of them and filesize < 253952 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY