There is no description at this point.
rule win_fengine_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.fengine." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fengine" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 72e2 8b5c2414 8d842490000000 50 } // n = 4, score = 100 // 72e2 | jb 0xffffffe4 // 8b5c2414 | mov ebx, dword ptr [esp + 0x14] // 8d842490000000 | lea eax, [esp + 0x90] // 50 | push eax $sequence_1 = { 833cfd4010410000 755b 6a18 e8???????? 59 } // n = 5, score = 100 // 833cfd4010410000 | cmp dword ptr [edi*8 + 0x411040], 0 // 755b | jne 0x5d // 6a18 | push 0x18 // e8???????? | // 59 | pop ecx $sequence_2 = { 50 ff15???????? 68???????? 8d85fcf7ffff 6800080000 } // n = 5, score = 100 // 50 | push eax // ff15???????? | // 68???????? | // 8d85fcf7ffff | lea eax, [ebp - 0x804] // 6800080000 | push 0x800 $sequence_3 = { 7405 352083b8ed 46 3bf7 0f825fffffff 5f } // n = 6, score = 100 // 7405 | je 7 // 352083b8ed | xor eax, 0xedb88320 // 46 | inc esi // 3bf7 | cmp esi, edi // 0f825fffffff | jb 0xffffff65 // 5f | pop edi $sequence_4 = { c1e81e 83e001 83e101 8d0c48 8bc6 } // n = 5, score = 100 // c1e81e | shr eax, 0x1e // 83e001 | and eax, 1 // 83e101 | and ecx, 1 // 8d0c48 | lea ecx, [eax + ecx*2] // 8bc6 | mov eax, esi $sequence_5 = { 53 8d4e04 6800080000 51 } // n = 4, score = 100 // 53 | push ebx // 8d4e04 | lea ecx, [esi + 4] // 6800080000 | push 0x800 // 51 | push ecx $sequence_6 = { 56 e8???????? 8b8de4feffff 8b95e0feffff 8b413c 03c6 8bb5dcfeffff } // n = 7, score = 100 // 56 | push esi // e8???????? | // 8b8de4feffff | mov ecx, dword ptr [ebp - 0x11c] // 8b95e0feffff | mov edx, dword ptr [ebp - 0x120] // 8b413c | mov eax, dword ptr [ecx + 0x3c] // 03c6 | add eax, esi // 8bb5dcfeffff | mov esi, dword ptr [ebp - 0x124] $sequence_7 = { 83c408 85c0 750f c705????????03000000 e9???????? ffb5bcfaffff } // n = 6, score = 100 // 83c408 | add esp, 8 // 85c0 | test eax, eax // 750f | jne 0x11 // c705????????03000000 | // e9???????? | // ffb5bcfaffff | push dword ptr [ebp - 0x544] $sequence_8 = { eb23 8b9d2ce5ffff 8a02 8b0c9d60514100 } // n = 4, score = 100 // eb23 | jmp 0x25 // 8b9d2ce5ffff | mov ebx, dword ptr [ebp - 0x1ad4] // 8a02 | mov al, byte ptr [edx] // 8b0c9d60514100 | mov ecx, dword ptr [ebx*4 + 0x415160] $sequence_9 = { 83e31f c1e306 8b048560514100 0fbe441804 83e001 } // n = 5, score = 100 // 83e31f | and ebx, 0x1f // c1e306 | shl ebx, 6 // 8b048560514100 | mov eax, dword ptr [eax*4 + 0x415160] // 0fbe441804 | movsx eax, byte ptr [eax + ebx + 4] // 83e001 | and eax, 1 condition: 7 of them and filesize < 210944 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY