There is no description at this point.
rule win_flowershop_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.flowershop." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flowershop" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c3 55 8bec 81ec0c020000 53 33db 391d???????? } // n = 7, score = 500 // c3 | ret // 55 | push ebp // 8bec | mov ebp, esp // 81ec0c020000 | sub esp, 0x20c // 53 | push ebx // 33db | xor ebx, ebx // 391d???????? | $sequence_1 = { 85c0 7502 33f6 8325????????00 } // n = 4, score = 500 // 85c0 | test eax, eax // 7502 | jne 4 // 33f6 | xor esi, esi // 8325????????00 | $sequence_2 = { 8b7dfc 8b5510 8a08 3a0c02 74db 8d450f 6a01 } // n = 7, score = 500 // 8b7dfc | mov edi, dword ptr [ebp - 4] // 8b5510 | mov edx, dword ptr [ebp + 0x10] // 8a08 | mov cl, byte ptr [eax] // 3a0c02 | cmp cl, byte ptr [edx + eax] // 74db | je 0xffffffdd // 8d450f | lea eax, [ebp + 0xf] // 6a01 | push 1 $sequence_3 = { 894610 89460c 33c0 5b eb69 e8???????? 85c0 } // n = 7, score = 500 // 894610 | mov dword ptr [esi + 0x10], eax // 89460c | mov dword ptr [esi + 0xc], eax // 33c0 | xor eax, eax // 5b | pop ebx // eb69 | jmp 0x6b // e8???????? | // 85c0 | test eax, eax $sequence_4 = { 0fb70d???????? 8bc2 8bd9 2bc1 2bda 8d7c07ff 8d741e01 } // n = 7, score = 500 // 0fb70d???????? | // 8bc2 | mov eax, edx // 8bd9 | mov ebx, ecx // 2bc1 | sub eax, ecx // 2bda | sub ebx, edx // 8d7c07ff | lea edi, [edi + eax - 1] // 8d741e01 | lea esi, [esi + ebx + 1] $sequence_5 = { 750b 881d???????? e9???????? 53 57 ff15???????? 83f8ff } // n = 7, score = 500 // 750b | jne 0xd // 881d???????? | // e9???????? | // 53 | push ebx // 57 | push edi // ff15???????? | // 83f8ff | cmp eax, -1 $sequence_6 = { a1???????? 8b4004 8906 8b45f8 83c00a 8907 33c0 } // n = 7, score = 500 // a1???????? | // 8b4004 | mov eax, dword ptr [eax + 4] // 8906 | mov dword ptr [esi], eax // 8b45f8 | mov eax, dword ptr [ebp - 8] // 83c00a | add eax, 0xa // 8907 | mov dword ptr [edi], eax // 33c0 | xor eax, eax $sequence_7 = { 7427 8bc7 83e003 84c0 751b f60601 6a00 } // n = 7, score = 500 // 7427 | je 0x29 // 8bc7 | mov eax, edi // 83e003 | and eax, 3 // 84c0 | test al, al // 751b | jne 0x1d // f60601 | test byte ptr [esi], 1 // 6a00 | push 0 $sequence_8 = { 752b 0fb715???????? 0fb70d???????? 8bc2 8bd9 2bc1 2bda } // n = 7, score = 500 // 752b | jne 0x2d // 0fb715???????? | // 0fb70d???????? | // 8bc2 | mov eax, edx // 8bd9 | mov ebx, ecx // 2bc1 | sub eax, ecx // 2bda | sub ebx, edx $sequence_9 = { 745f 8345fc0a 8d45e4 50 8975e0 ff15???????? 57 } // n = 7, score = 500 // 745f | je 0x61 // 8345fc0a | add dword ptr [ebp - 4], 0xa // 8d45e4 | lea eax, [ebp - 0x1c] // 50 | push eax // 8975e0 | mov dword ptr [ebp - 0x20], esi // ff15???????? | // 57 | push edi condition: 7 of them and filesize < 829440 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY