There is no description at this point.
rule win_compfun_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.compfun." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d857cfeffff 50 8d857cffffff 50 e8???????? 59 50 } // n = 7, score = 300 // 8d857cfeffff | lea eax, [ebp - 0x184] // 50 | push eax // 8d857cffffff | lea eax, [ebp - 0x84] // 50 | push eax // e8???????? | // 59 | pop ecx // 50 | push eax $sequence_1 = { c7460c65726174 c746106f722063 c746146c617373 c6461800 8bc6 5e } // n = 6, score = 300 // c7460c65726174 | mov dword ptr [esi + 0xc], 0x74617265 // c746106f722063 | mov dword ptr [esi + 0x10], 0x6320726f // c746146c617373 | mov dword ptr [esi + 0x14], 0x7373616c // c6461800 | mov byte ptr [esi + 0x18], 0 // 8bc6 | mov eax, esi // 5e | pop esi $sequence_2 = { 56 e8???????? 83c40c c74608697a6520 c70647657446 c74604696c6553 c6460b00 } // n = 7, score = 300 // 56 | push esi // e8???????? | // 83c40c | add esp, 0xc // c74608697a6520 | mov dword ptr [esi + 8], 0x20657a69 // c70647657446 | mov dword ptr [esi], 0x46746547 // c74604696c6553 | mov dword ptr [esi + 4], 0x53656c69 // c6460b00 | mov byte ptr [esi + 0xb], 0 $sequence_3 = { c7460472656174 c7460865557365 c7460c72546872 c6461300 } // n = 4, score = 300 // c7460472656174 | mov dword ptr [esi + 4], 0x74616572 // c7460865557365 | mov dword ptr [esi + 8], 0x65735565 // c7460c72546872 | mov dword ptr [esi + 0xc], 0x72685472 // c6461300 | mov byte ptr [esi + 0x13], 0 $sequence_4 = { e8???????? 83c40c c7460c33322020 c706496e7072 } // n = 4, score = 300 // e8???????? | // 83c40c | add esp, 0xc // c7460c33322020 | mov dword ptr [esi + 0xc], 0x20203233 // c706496e7072 | mov dword ptr [esi], 0x72706e49 $sequence_5 = { 6880000000 6a00 56 e8???????? 83c40c c70647657446 c74604756c6c50 } // n = 7, score = 300 // 6880000000 | push 0x80 // 6a00 | push 0 // 56 | push esi // e8???????? | // 83c40c | add esp, 0xc // c70647657446 | mov dword ptr [esi], 0x46746547 // c74604756c6c50 | mov dword ptr [esi + 4], 0x506c6c75 $sequence_6 = { c6460f00 8bc6 5e 5d c3 55 } // n = 6, score = 300 // c6460f00 | mov byte ptr [esi + 0xf], 0 // 8bc6 | mov eax, esi // 5e | pop esi // 5d | pop ebp // c3 | ret // 55 | push ebp $sequence_7 = { c7460825202020 c70625415050 c7460444415441 c6460900 8bc6 5e } // n = 6, score = 300 // c7460825202020 | mov dword ptr [esi + 8], 0x20202025 // c70625415050 | mov dword ptr [esi], 0x50504125 // c7460444415441 | mov dword ptr [esi + 4], 0x41544144 // c6460900 | mov byte ptr [esi + 9], 0 // 8bc6 | mov eax, esi // 5e | pop esi $sequence_8 = { 034c2460 488b442450 894820 488b4c2450 } // n = 4, score = 100 // 034c2460 | lea edx, [esp + 0x40] // 488b442450 | dec eax // 894820 | mov ecx, dword ptr [esp + 0x70] // 488b4c2450 | add ecx, dword ptr [esp + 0x2c] $sequence_9 = { 03c1 4863d0 488b4c2430 488b442438 } // n = 4, score = 100 // 03c1 | add ecx, dword ptr [esp + 0x60] // 4863d0 | dec eax // 488b4c2430 | mov eax, dword ptr [esp + 0x50] // 488b442438 | mov dword ptr [eax + 0x20], ecx $sequence_10 = { 03c1 89442420 8b442420 83c001 } // n = 4, score = 100 // 03c1 | add ecx, dword ptr [esp + 0x60] // 89442420 | dec eax // 8b442420 | mov eax, dword ptr [esp + 0x50] // 83c001 | mov dword ptr [eax + 0x20], ecx $sequence_11 = { 03c1 89442420 8b4c2438 488b442450 } // n = 4, score = 100 // 03c1 | dec eax // 89442420 | mov eax, dword ptr [esp + 0x38] // 8b4c2438 | inc edx // 488b442450 | movzx eax, byte ptr [eax + eax] $sequence_12 = { 03c1 89442420 8b542438 486bd218 } // n = 4, score = 100 // 03c1 | movzx eax, byte ptr [eax + eax] // 89442420 | mov byte ptr [ecx + edx], al // 8b542438 | mov eax, dword ptr [esp + 0x18] // 486bd218 | add eax, ecx $sequence_13 = { 034c242c 488b442470 894820 488d542440 } // n = 4, score = 100 // 034c242c | add eax, dword ptr [esp + 0x2c] // 488b442470 | mov ecx, eax // 894820 | dec eax // 488d542440 | mov dword ptr [esp + 0x48], eax $sequence_14 = { 03c1 89442434 8b442430 39442434 } // n = 4, score = 100 // 03c1 | mov dword ptr [esp + 0x20], eax // 89442434 | mov eax, dword ptr [esp + 0x20] // 8b442430 | add eax, 0xa // 39442434 | add eax, ecx $sequence_15 = { 0344242c 8bc8 e8???????? 4889442448 } // n = 4, score = 100 // 0344242c | add eax, dword ptr [esp + 0x2c] // 8bc8 | mov ecx, eax // e8???????? | // 4889442448 | dec eax condition: 7 of them and filesize < 402432 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY