Actor(s): Groundbait
There is no description at this point.
rule win_prikormka_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.prikormka." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d0446 50 e8???????? 83c40c 6a00 56 } // n = 6, score = 1600 // 8d0446 | lea eax, [esi + eax*2] // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 6a00 | push 0 // 56 | push esi $sequence_1 = { e8???????? 8b1d???????? 83c40c 6a00 56 ffd3 8b2d???????? } // n = 7, score = 1400 // e8???????? | // 8b1d???????? | // 83c40c | add esp, 0xc // 6a00 | push 0 // 56 | push esi // ffd3 | call ebx // 8b2d???????? | $sequence_2 = { 8d1446 52 e8???????? 83c40c } // n = 4, score = 1400 // 8d1446 | lea edx, [esi + eax*2] // 52 | push edx // e8???????? | // 83c40c | add esp, 0xc $sequence_3 = { ffd3 85c0 7405 6a02 } // n = 4, score = 1400 // ffd3 | call ebx // 85c0 | test eax, eax // 7405 | je 7 // 6a02 | push 2 $sequence_4 = { 6800020000 ff15???????? 68???????? ffd7 } // n = 4, score = 1400 // 6800020000 | push 0x200 // ff15???????? | // 68???????? | // ffd7 | call edi $sequence_5 = { 51 e8???????? 83c40c 68???????? ffd7 } // n = 5, score = 1400 // 51 | push ecx // e8???????? | // 83c40c | add esp, 0xc // 68???????? | // ffd7 | call edi $sequence_6 = { 740e 68???????? 50 ff15???????? ffd0 } // n = 5, score = 1400 // 740e | je 0x10 // 68???????? | // 50 | push eax // ff15???????? | // ffd0 | call eax $sequence_7 = { 7420 68???????? ffd7 03c0 50 68???????? 56 } // n = 7, score = 1400 // 7420 | je 0x22 // 68???????? | // ffd7 | call edi // 03c0 | add eax, eax // 50 | push eax // 68???????? | // 56 | push esi $sequence_8 = { 7502 59 c3 50 ff15???????? b801000000 } // n = 6, score = 1000 // 7502 | jne 4 // 59 | pop ecx // c3 | ret // 50 | push eax // ff15???????? | // b801000000 | mov eax, 1 $sequence_9 = { 7408 41 42 3bce } // n = 4, score = 1000 // 7408 | je 0xa // 41 | inc ecx // 42 | inc edx // 3bce | cmp ecx, esi $sequence_10 = { 6a00 6a00 ff15???????? 85c0 7502 59 c3 } // n = 7, score = 1000 // 6a00 | push 0 // 6a00 | push 0 // ff15???????? | // 85c0 | test eax, eax // 7502 | jne 4 // 59 | pop ecx // c3 | ret $sequence_11 = { 83c40c 8d442404 50 ff15???????? 5e } // n = 5, score = 1000 // 83c40c | add esp, 0xc // 8d442404 | lea eax, [esp + 4] // 50 | push eax // ff15???????? | // 5e | pop esi $sequence_12 = { c3 57 6a00 6a00 6a00 6a02 } // n = 6, score = 900 // c3 | ret // 57 | push edi // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 6a02 | push 2 $sequence_13 = { 83ec08 68???????? ff15???????? 0fb7c0 } // n = 4, score = 900 // 83ec08 | sub esp, 8 // 68???????? | // ff15???????? | // 0fb7c0 | movzx eax, ax $sequence_14 = { ff15???????? ffd0 c705????????01000000 c705????????01000000 } // n = 4, score = 900 // ff15???????? | // ffd0 | call eax // c705????????01000000 | // c705????????01000000 | $sequence_15 = { 5e 85c0 7422 68???????? 50 } // n = 5, score = 900 // 5e | pop esi // 85c0 | test eax, eax // 7422 | je 0x24 // 68???????? | // 50 | push eax $sequence_16 = { ff15???????? 0fb7c0 6683f805 7d09 } // n = 4, score = 900 // ff15???????? | // 0fb7c0 | movzx eax, ax // 6683f805 | cmp ax, 5 // 7d09 | jge 0xb $sequence_17 = { 5e 85c0 7414 c705????????01000000 c705????????01000000 } // n = 5, score = 700 // 5e | pop esi // 85c0 | test eax, eax // 7414 | je 0x16 // c705????????01000000 | // c705????????01000000 | $sequence_18 = { 33f6 e8???????? e8???????? e8???????? e8???????? e8???????? e8???????? } // n = 7, score = 700 // 33f6 | xor esi, esi // e8???????? | // e8???????? | // e8???????? | // e8???????? | // e8???????? | // e8???????? | $sequence_19 = { 6685d2 75f5 2bce 8d1400 52 d1f9 } // n = 6, score = 600 // 6685d2 | test dx, dx // 75f5 | jne 0xfffffff7 // 2bce | sub ecx, esi // 8d1400 | lea edx, [eax + eax] // 52 | push edx // d1f9 | sar ecx, 1 $sequence_20 = { 6a00 ff15???????? 8bf0 ff15???????? 3db7000000 751f } // n = 6, score = 600 // 6a00 | push 0 // ff15???????? | // 8bf0 | mov esi, eax // ff15???????? | // 3db7000000 | cmp eax, 0xb7 // 751f | jne 0x21 $sequence_21 = { ff15???????? 3db7000000 751f 56 ff15???????? 33c0 } // n = 6, score = 600 // ff15???????? | // 3db7000000 | cmp eax, 0xb7 // 751f | jne 0x21 // 56 | push esi // ff15???????? | // 33c0 | xor eax, eax $sequence_22 = { 75f5 8b0d???????? 2bc2 8b15???????? } // n = 4, score = 600 // 75f5 | jne 0xfffffff7 // 8b0d???????? | // 2bc2 | sub eax, edx // 8b15???????? | $sequence_23 = { e8???????? 8b35???????? 83c40c 68???????? ffd6 03c0 } // n = 6, score = 500 // e8???????? | // 8b35???????? | // 83c40c | add esp, 0xc // 68???????? | // ffd6 | call esi // 03c0 | add eax, eax $sequence_24 = { 50 e8???????? b8???????? 83c40c 8d5002 } // n = 5, score = 500 // 50 | push eax // e8???????? | // b8???????? | // 83c40c | add esp, 0xc // 8d5002 | lea edx, [eax + 2] $sequence_25 = { d1f8 8d7102 8da42400000000 668b11 83c102 6685d2 } // n = 6, score = 500 // d1f8 | sar eax, 1 // 8d7102 | lea esi, [ecx + 2] // 8da42400000000 | lea esp, [esp] // 668b11 | mov dx, word ptr [ecx] // 83c102 | add ecx, 2 // 6685d2 | test dx, dx $sequence_26 = { 6685c9 75f5 2bc6 8d0c12 51 d1f8 } // n = 6, score = 500 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc6 | sub eax, esi // 8d0c12 | lea ecx, [edx + edx] // 51 | push ecx // d1f8 | sar eax, 1 $sequence_27 = { 52 0fb754241c 50 0fb7442422 51 } // n = 5, score = 400 // 52 | push edx // 0fb754241c | movzx edx, word ptr [esp + 0x1c] // 50 | push eax // 0fb7442422 | movzx eax, word ptr [esp + 0x22] // 51 | push ecx $sequence_28 = { 83c40c 8d5002 668b08 83c002 6685c9 75f5 8b0d???????? } // n = 7, score = 400 // 83c40c | add esp, 0xc // 8d5002 | lea edx, [eax + 2] // 668b08 | mov cx, word ptr [eax] // 83c002 | add eax, 2 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 8b0d???????? | $sequence_29 = { 85c0 7409 6a02 68???????? } // n = 4, score = 400 // 85c0 | test eax, eax // 7409 | je 0xb // 6a02 | push 2 // 68???????? | $sequence_30 = { 8b3d???????? 85f6 7420 68???????? } // n = 4, score = 300 // 8b3d???????? | // 85f6 | test esi, esi // 7420 | je 0x22 // 68???????? | $sequence_31 = { e8???????? 83c40c eb0d 6a00 6800020000 ff15???????? } // n = 6, score = 300 // e8???????? | // 83c40c | add esp, 0xc // eb0d | jmp 0xf // 6a00 | push 0 // 6800020000 | push 0x200 // ff15???????? | $sequence_32 = { 6685c9 75f5 2bc2 b9???????? d1f8 8d7102 668b11 } // n = 7, score = 300 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc2 | sub eax, edx // b9???????? | // d1f8 | sar eax, 1 // 8d7102 | lea esi, [ecx + 2] // 668b11 | mov dx, word ptr [ecx] $sequence_33 = { 75f5 8d1400 2bce 52 d1f9 } // n = 5, score = 300 // 75f5 | jne 0xfffffff7 // 8d1400 | lea edx, [eax + eax] // 2bce | sub ecx, esi // 52 | push edx // d1f9 | sar ecx, 1 $sequence_34 = { 2bc6 03d2 52 d1f8 } // n = 4, score = 300 // 2bc6 | sub eax, esi // 03d2 | add edx, edx // 52 | push edx // d1f8 | sar eax, 1 $sequence_35 = { 68???????? 33ff 57 57 ff15???????? 8bf0 } // n = 6, score = 300 // 68???????? | // 33ff | xor edi, edi // 57 | push edi // 57 | push edi // ff15???????? | // 8bf0 | mov esi, eax $sequence_36 = { 75f5 2bc2 d1f8 8bd0 b8???????? 8d7002 } // n = 6, score = 300 // 75f5 | jne 0xfffffff7 // 2bc2 | sub eax, edx // d1f8 | sar eax, 1 // 8bd0 | mov edx, eax // b8???????? | // 8d7002 | lea esi, [eax + 2] $sequence_37 = { 8bd0 b8???????? 8d7002 8da42400000000 668b08 83c002 } // n = 6, score = 300 // 8bd0 | mov edx, eax // b8???????? | // 8d7002 | lea esi, [eax + 2] // 8da42400000000 | lea esp, [esp] // 668b08 | mov cx, word ptr [eax] // 83c002 | add eax, 2 $sequence_38 = { ffd6 50 68???????? 57 ffd6 03c7 50 } // n = 7, score = 300 // ffd6 | call esi // 50 | push eax // 68???????? | // 57 | push edi // ffd6 | call esi // 03c7 | add eax, edi // 50 | push eax $sequence_39 = { 83c202 6685c0 75f5 2bd6 8d0409 50 d1fa } // n = 7, score = 200 // 83c202 | add edx, 2 // 6685c0 | test ax, ax // 75f5 | jne 0xfffffff7 // 2bd6 | sub edx, esi // 8d0409 | lea eax, [ecx + ecx] // 50 | push eax // d1fa | sar edx, 1 $sequence_40 = { c20400 83c108 51 ff742410 } // n = 4, score = 100 // c20400 | ret 4 // 83c108 | add ecx, 8 // 51 | push ecx // ff742410 | push dword ptr [esp + 0x10] $sequence_41 = { ffd7 ff756c ff15???????? 56 } // n = 4, score = 100 // ffd7 | call edi // ff756c | push dword ptr [ebp + 0x6c] // ff15???????? | // 56 | push esi $sequence_42 = { 8b06 56 ff502c 8bf8 85ff 7c2b } // n = 6, score = 100 // 8b06 | mov eax, dword ptr [esi] // 56 | push esi // ff502c | call dword ptr [eax + 0x2c] // 8bf8 | mov edi, eax // 85ff | test edi, edi // 7c2b | jl 0x2d $sequence_43 = { 0f8cc0000000 ff75e4 e8???????? 59 894510 } // n = 5, score = 100 // 0f8cc0000000 | jl 0xc6 // ff75e4 | push dword ptr [ebp - 0x1c] // e8???????? | // 59 | pop ecx // 894510 | mov dword ptr [ebp + 0x10], eax $sequence_44 = { 81ec94000000 53 56 57 33f6 6a38 } // n = 6, score = 100 // 81ec94000000 | sub esp, 0x94 // 53 | push ebx // 56 | push esi // 57 | push edi // 33f6 | xor esi, esi // 6a38 | push 0x38 $sequence_45 = { ff15???????? 395de8 7512 ff35???????? } // n = 4, score = 100 // ff15???????? | // 395de8 | cmp dword ptr [ebp - 0x18], ebx // 7512 | jne 0x14 // ff35???????? | condition: 7 of them and filesize < 401408 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY