There is no description at this point.
rule win_excalibur_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.excalibur." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.excalibur" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { d1f9 51 57 8d4c2434 e8???????? 6a07 51 } // n = 7, score = 100 // d1f9 | sar ecx, 1 // 51 | push ecx // 57 | push edi // 8d4c2434 | lea ecx, [esp + 0x34] // e8???????? | // 6a07 | push 7 // 51 | push ecx $sequence_1 = { e8???????? 8be5 5d c3 c70701000000 c7470401000000 f6c320 } // n = 7, score = 100 // e8???????? | // 8be5 | mov esp, ebp // 5d | pop ebp // c3 | ret // c70701000000 | mov dword ptr [edi], 1 // c7470401000000 | mov dword ptr [edi + 4], 1 // f6c320 | test bl, 0x20 $sequence_2 = { ff8db8e5ffff 0f8541fdffff 68???????? 6880000000 6a34 8d85f0e5ffff 50 } // n = 7, score = 100 // ff8db8e5ffff | dec dword ptr [ebp - 0x1a48] // 0f8541fdffff | jne 0xfffffd47 // 68???????? | // 6880000000 | push 0x80 // 6a34 | push 0x34 // 8d85f0e5ffff | lea eax, [ebp - 0x1a10] // 50 | push eax $sequence_3 = { c785d8fbffff07000000 c785d4fbffff00000000 668985c4fbffff 720e ffb588fbffff e8???????? 83c404 } // n = 7, score = 100 // c785d8fbffff07000000 | mov dword ptr [ebp - 0x428], 7 // c785d4fbffff00000000 | mov dword ptr [ebp - 0x42c], 0 // 668985c4fbffff | mov word ptr [ebp - 0x43c], ax // 720e | jb 0x10 // ffb588fbffff | push dword ptr [ebp - 0x478] // e8???????? | // 83c404 | add esp, 4 $sequence_4 = { c745e807000000 c745e400000000 668945d4 c745fc00000000 85db 750c 33c0 } // n = 7, score = 100 // c745e807000000 | mov dword ptr [ebp - 0x18], 7 // c745e400000000 | mov dword ptr [ebp - 0x1c], 0 // 668945d4 | mov word ptr [ebp - 0x2c], ax // c745fc00000000 | mov dword ptr [ebp - 4], 0 // 85db | test ebx, ebx // 750c | jne 0xe // 33c0 | xor eax, eax $sequence_5 = { c645fc06 e8???????? 83bd2cffffff10 720e ffb518ffffff e8???????? 83c404 } // n = 7, score = 100 // c645fc06 | mov byte ptr [ebp - 4], 6 // e8???????? | // 83bd2cffffff10 | cmp dword ptr [ebp - 0xd4], 0x10 // 720e | jb 0x10 // ffb518ffffff | push dword ptr [ebp - 0xe8] // e8???????? | // 83c404 | add esp, 4 $sequence_6 = { 8d5508 8d8dd8feffff e8???????? 83c404 8d85c0feffff 50 } // n = 6, score = 100 // 8d5508 | lea edx, [ebp + 8] // 8d8dd8feffff | lea ecx, [ebp - 0x128] // e8???????? | // 83c404 | add esp, 4 // 8d85c0feffff | lea eax, [ebp - 0x140] // 50 | push eax $sequence_7 = { 8bfa 897de8 8bf1 c745fc00000000 c745f000000000 6a00 c746140f000000 } // n = 7, score = 100 // 8bfa | mov edi, edx // 897de8 | mov dword ptr [ebp - 0x18], edi // 8bf1 | mov esi, ecx // c745fc00000000 | mov dword ptr [ebp - 4], 0 // c745f000000000 | mov dword ptr [ebp - 0x10], 0 // 6a00 | push 0 // c746140f000000 | mov dword ptr [esi + 0x14], 0xf $sequence_8 = { c645fc01 83bdd4e5ffff08 720e ffb5c0e5ffff e8???????? 83c404 83c734 } // n = 7, score = 100 // c645fc01 | mov byte ptr [ebp - 4], 1 // 83bdd4e5ffff08 | cmp dword ptr [ebp - 0x1a2c], 8 // 720e | jb 0x10 // ffb5c0e5ffff | push dword ptr [ebp - 0x1a40] // e8???????? | // 83c404 | add esp, 4 // 83c734 | add edi, 0x34 $sequence_9 = { 85c0 745a 8b15???????? 8b0d???????? a1???????? 49 23ca } // n = 7, score = 100 // 85c0 | test eax, eax // 745a | je 0x5c // 8b15???????? | // 8b0d???????? | // a1???????? | // 49 | dec ecx // 23ca | and ecx, edx condition: 7 of them and filesize < 1253376 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY