There is no description at this point.
rule win_polyglot_ransom_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.polyglot_ransom." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.polyglot_ransom" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 50 8d85c4efffff 50 e8???????? 53 8d85fcefffff 50 } // n = 7, score = 100 // 50 | push eax // 8d85c4efffff | lea eax, [ebp - 0x103c] // 50 | push eax // e8???????? | // 53 | push ebx // 8d85fcefffff | lea eax, [ebp - 0x1004] // 50 | push eax $sequence_1 = { 50 898534d9ffff e8???????? 83c440 ffb534d9ffff 8bd8 56 } // n = 7, score = 100 // 50 | push eax // 898534d9ffff | mov dword ptr [ebp - 0x26cc], eax // e8???????? | // 83c440 | add esp, 0x40 // ffb534d9ffff | push dword ptr [ebp - 0x26cc] // 8bd8 | mov ebx, eax // 56 | push esi $sequence_2 = { 59 8d7e50 59 8907 895e54 33db 395e54 } // n = 7, score = 100 // 59 | pop ecx // 8d7e50 | lea edi, [esi + 0x50] // 59 | pop ecx // 8907 | mov dword ptr [edi], eax // 895e54 | mov dword ptr [esi + 0x54], ebx // 33db | xor ebx, ebx // 395e54 | cmp dword ptr [esi + 0x54], ebx $sequence_3 = { 69667261646f20 6465207072 7565 62612e 3c2f 68313e0d0a 3c73 } // n = 7, score = 100 // 69667261646f20 | imul esp, dword ptr [esi + 0x72], 0x206f6461 // 6465207072 | and byte ptr gs:[eax + 0x72], dh // 7565 | jne 0x67 // 62612e | bound esp, qword ptr [ecx + 0x2e] // 3c2f | cmp al, 0x2f // 68313e0d0a | push 0xa0d3e31 // 3c73 | cmp al, 0x73 $sequence_4 = { 8bc3 56 50 e8???????? 85c0 59 59 } // n = 7, score = 100 // 8bc3 | mov eax, ebx // 56 | push esi // 50 | push eax // e8???????? | // 85c0 | test eax, eax // 59 | pop ecx // 59 | pop ecx $sequence_5 = { 656d 657265 2027 52 6970726f766127 3c70 2f } // n = 7, score = 100 // 656d | insd dword ptr es:[edi], dx // 657265 | jb 0x68 // 2027 | and byte ptr [edi], ah // 52 | push edx // 6970726f766127 | imul esi, dword ptr [eax + 0x72], 0x2761766f // 3c70 | cmp al, 0x70 // 2f | das $sequence_6 = { e8???????? 59 e8???????? 50 8d8dbcefffff e8???????? c645fc02 } // n = 7, score = 100 // e8???????? | // 59 | pop ecx // e8???????? | // 50 | push eax // 8d8dbcefffff | lea ecx, [ebp - 0x1044] // e8???????? | // c645fc02 | mov byte ptr [ebp - 4], 2 $sequence_7 = { e8???????? 8b06 8bce 897e44 ff5010 8b4508 834dccff } // n = 7, score = 100 // e8???????? | // 8b06 | mov eax, dword ptr [esi] // 8bce | mov ecx, esi // 897e44 | mov dword ptr [esi + 0x44], edi // ff5010 | call dword ptr [eax + 0x10] // 8b4508 | mov eax, dword ptr [ebp + 8] // 834dccff | or dword ptr [ebp - 0x34], 0xffffffff $sequence_8 = { 837df800 7616 8b8608010000 ff75f8 ff7004 ff30 e8???????? } // n = 7, score = 100 // 837df800 | cmp dword ptr [ebp - 8], 0 // 7616 | jbe 0x18 // 8b8608010000 | mov eax, dword ptr [esi + 0x108] // ff75f8 | push dword ptr [ebp - 8] // ff7004 | push dword ptr [eax + 4] // ff30 | push dword ptr [eax] // e8???????? | $sequence_9 = { 894624 740c 50 e8???????? } // n = 4, score = 100 // 894624 | mov dword ptr [esi + 0x24], eax // 740c | je 0xe // 50 | push eax // e8???????? | condition: 7 of them and filesize < 1392640 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY