Actor(s): Calypso group
There is no description at this point.
rule win_flying_dutchman_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.flying_dutchman." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flying_dutchman" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 5f 89bde4feffff 899de0feffff 889dd0feffff 6804010000 8d85ecfeffff } // n = 6, score = 100 // 5f | pop edi // 89bde4feffff | mov dword ptr [ebp - 0x11c], edi // 899de0feffff | mov dword ptr [ebp - 0x120], ebx // 889dd0feffff | mov byte ptr [ebp - 0x130], bl // 6804010000 | push 0x104 // 8d85ecfeffff | lea eax, [ebp - 0x114] $sequence_1 = { 59 85db 7454 ff7608 ff7604 53 e8???????? } // n = 7, score = 100 // 59 | pop ecx // 85db | test ebx, ebx // 7454 | je 0x56 // ff7608 | push dword ptr [esi + 8] // ff7604 | push dword ptr [esi + 4] // 53 | push ebx // e8???????? | $sequence_2 = { 3bd8 7624 8bc8 d1e8 ba97c12800 2bd0 3bd1 } // n = 7, score = 100 // 3bd8 | cmp ebx, eax // 7624 | jbe 0x26 // 8bc8 | mov ecx, eax // d1e8 | shr eax, 1 // ba97c12800 | mov edx, 0x28c197 // 2bd0 | sub edx, eax // 3bd1 | cmp edx, ecx $sequence_3 = { 0fbe84c1686e0110 6a07 c1f804 59 8985a0fdffff 3bc1 0f87cb090000 } // n = 7, score = 100 // 0fbe84c1686e0110 | movsx eax, byte ptr [ecx + eax*8 + 0x10016e68] // 6a07 | push 7 // c1f804 | sar eax, 4 // 59 | pop ecx // 8985a0fdffff | mov dword ptr [ebp - 0x260], eax // 3bc1 | cmp eax, ecx // 0f87cb090000 | ja 0x9d1 $sequence_4 = { ff15???????? ebe0 8b8c24a4010000 5f 5e 5b } // n = 6, score = 100 // ff15???????? | // ebe0 | jmp 0xffffffe2 // 8b8c24a4010000 | mov ecx, dword ptr [esp + 0x1a4] // 5f | pop edi // 5e | pop esi // 5b | pop ebx $sequence_5 = { 89bd54fdffff 89b558fdffff 6a0f c745fc03000000 5b 895f14 } // n = 6, score = 100 // 89bd54fdffff | mov dword ptr [ebp - 0x2ac], edi // 89b558fdffff | mov dword ptr [ebp - 0x2a8], esi // 6a0f | push 0xf // c745fc03000000 | mov dword ptr [ebp - 4], 3 // 5b | pop ebx // 895f14 | mov dword ptr [edi + 0x14], ebx $sequence_6 = { c78502fffffffefefefe c78506fffffffefefefe c7850afffffffefefefe 66c7850efffffffefe 888d10ffffff } // n = 5, score = 100 // c78502fffffffefefefe | mov dword ptr [ebp - 0xfe], 0xfefefefe // c78506fffffffefefefe | mov dword ptr [ebp - 0xfa], 0xfefefefe // c7850afffffffefefefe | mov dword ptr [ebp - 0xf6], 0xfefefefe // 66c7850efffffffefe | mov word ptr [ebp - 0xf2], 0xfefe // 888d10ffffff | mov byte ptr [ebp - 0xf0], cl $sequence_7 = { ff15???????? 397e20 0f8448ffffff 68d0070000 ff15???????? 397e24 74e7 } // n = 7, score = 100 // ff15???????? | // 397e20 | cmp dword ptr [esi + 0x20], edi // 0f8448ffffff | je 0xffffff4e // 68d0070000 | push 0x7d0 // ff15???????? | // 397e24 | cmp dword ptr [esi + 0x24], edi // 74e7 | je 0xffffffe9 $sequence_8 = { 897010 897014 8bf0 53 6828a40000 57 } // n = 6, score = 100 // 897010 | mov dword ptr [eax + 0x10], esi // 897014 | mov dword ptr [eax + 0x14], esi // 8bf0 | mov esi, eax // 53 | push ebx // 6828a40000 | push 0xa428 // 57 | push edi $sequence_9 = { 5e 40 5b 59 5d c20400 55 } // n = 7, score = 100 // 5e | pop esi // 40 | inc eax // 5b | pop ebx // 59 | pop ecx // 5d | pop ebp // c20400 | ret 4 // 55 | push ebp condition: 7 of them and filesize < 276480 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY