There is no description at this point.
rule win_mail_o_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.mail_o." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mail_o" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ff15???????? 4885c0 756a 4c8d0dfca30b00 c7442420b7000000 8d5065 8d4825 } // n = 7, score = 100 // ff15???????? | // 4885c0 | je 0x90f // 756a | dec eax // 4c8d0dfca30b00 | mov ecx, edx // c7442420b7000000 | dec eax // 8d5065 | mov dword ptr [esp + 0x40], edx // 8d4825 | dec eax $sequence_1 = { e8???????? 498b0e 488be8 8b81740e0000 84c0 7847 41f6877006000008 } // n = 7, score = 100 // e8???????? | // 498b0e | mov dword ptr [esp + 0x68], eax // 488be8 | dec eax // 8b81740e0000 | mov eax, dword ptr [ebp - 8] // 84c0 | dec eax // 7847 | mov dword ptr [ebp - 0x80], eax // 41f6877006000008 | dec eax $sequence_2 = { f20f102d???????? f20f2cc3 660f6ec0 8d5001 f30fe6c0 f20f5cd8 660f2fdd } // n = 7, score = 100 // f20f102d???????? | // f20f2cc3 | jb 0x1a36 // 660f6ec0 | dec eax // 8d5001 | mov edx, dword ptr [ecx + 0x240] // f30fe6c0 | dec ebp // f20f5cd8 | sub eax, ecx // 660f2fdd | dec esp $sequence_3 = { e8???????? f6c302 7420 ba79000000 c744242060000000 4c8d0dcd591000 448d42fd } // n = 7, score = 100 // e8???????? | // f6c302 | dec eax // 7420 | add esp, 0x20 // ba79000000 | pop edi // c744242060000000 | ret // 4c8d0dcd591000 | test byte ptr [ecx + 0x80], 1 // 448d42fd | je 0x3a8 $sequence_4 = { e9???????? 8b4de0 e8???????? e9???????? 488d05c58f0b00 4a8b04e8 42f644303840 } // n = 7, score = 100 // e9???????? | // 8b4de0 | dec eax // e8???????? | // e9???????? | // 488d05c58f0b00 | sub eax, edi // 4a8b04e8 | dec eax // 42f644303840 | mov eax, dword ptr [ebx + 0x1050] $sequence_5 = { e8???????? 85c0 7404 0fbaeb09 0fbae309 7239 498bcf } // n = 7, score = 100 // e8???????? | // 85c0 | dec esp // 7404 | mov eax, edi // 0fbaeb09 | dec eax // 0fbae309 | mov dword ptr [esp + 0x28], eax // 7239 | dec ecx // 498bcf | mov edx, esp $sequence_6 = { e8???????? 85c0 7435 0fb64708 4883c708 84c0 741a } // n = 7, score = 100 // e8???????? | // 85c0 | dec esp // 7435 | lea eax, [esp + 0x40] // 0fb64708 | dec eax // 4883c708 | lea ecx, [0xee115] // 84c0 | dec eax // 741a | mov edx, dword ptr [edx + 8] $sequence_7 = { e9???????? 498b06 48898340070000 e9???????? 498b00 48898150070000 e9???????? } // n = 7, score = 100 // e9???????? | // 498b06 | dec eax // 48898340070000 | lea edx, [0x18d9b5] // e9???????? | // 498b00 | dec eax // 48898150070000 | mov eax, dword ptr [ecx + 0x688] // e9???????? | $sequence_8 = { e9???????? 488d1535de1800 e9???????? 488d1539de1800 e9???????? 488d153dde1800 e9???????? } // n = 7, score = 100 // e9???????? | // 488d1535de1800 | je 0x1985 // e9???????? | // 488d1539de1800 | dec eax // e9???????? | // 488d153dde1800 | mov edi, dword ptr [edi + 0x10] // e9???????? | $sequence_9 = { eb2e 488b4048 4885c0 7510 c74424206d020000 41b884000000 eb15 } // n = 7, score = 100 // eb2e | dec eax // 488b4048 | mov ecx, dword ptr [ebx + 0xea0] // 4885c0 | test eax, eax // 7510 | je 0x1023 // c74424206d020000 | dec esp // 41b884000000 | mov eax, dword ptr [ebx + 0xbf0] // eb15 | dec eax condition: 7 of them and filesize < 5985280 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY