Actor(s): Leviathan
There is no description at this point.
rule win_sedll_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.sedll." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sedll" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83c410 6a00 6a00 ff75f4 } // n = 4, score = 200 // 83c410 | add esp, 0x10 // 6a00 | push 0 // 6a00 | push 0 // ff75f4 | push dword ptr [ebp - 0xc] $sequence_1 = { 75f9 2bca 8d75f0 8bd3 } // n = 4, score = 200 // 75f9 | jne 0xfffffffb // 2bca | sub ecx, edx // 8d75f0 | lea esi, [ebp - 0x10] // 8bd3 | mov edx, ebx $sequence_2 = { 8b45fc 8a440701 0fbec0 50 } // n = 4, score = 200 // 8b45fc | mov eax, dword ptr [ebp - 4] // 8a440701 | mov al, byte ptr [edi + eax + 1] // 0fbec0 | movsx eax, al // 50 | push eax $sequence_3 = { 83c602 6685c9 75f5 8bff 668b06 } // n = 5, score = 200 // 83c602 | add esi, 2 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 8bff | mov edi, edi // 668b06 | mov ax, word ptr [esi] $sequence_4 = { 85c0 0f8488000000 6a01 6a00 8d45f8 } // n = 5, score = 200 // 85c0 | test eax, eax // 0f8488000000 | je 0x8e // 6a01 | push 1 // 6a00 | push 0 // 8d45f8 | lea eax, [ebp - 8] $sequence_5 = { 8806 46 3b7dec 0f8c36ffffff } // n = 4, score = 200 // 8806 | mov byte ptr [esi], al // 46 | inc esi // 3b7dec | cmp edi, dword ptr [ebp - 0x14] // 0f8c36ffffff | jl 0xffffff3c $sequence_6 = { 85c0 b801000000 0f44d8 8b442418 46 } // n = 5, score = 200 // 85c0 | test eax, eax // b801000000 | mov eax, 1 // 0f44d8 | cmove ebx, eax // 8b442418 | mov eax, dword ptr [esp + 0x18] // 46 | inc esi $sequence_7 = { 85c0 b801000000 0f44d8 8b442418 46 3b742410 7cdb } // n = 7, score = 200 // 85c0 | test eax, eax // b801000000 | mov eax, 1 // 0f44d8 | cmove ebx, eax // 8b442418 | mov eax, dword ptr [esp + 0x18] // 46 | inc esi // 3b742410 | cmp esi, dword ptr [esp + 0x10] // 7cdb | jl 0xffffffdd $sequence_8 = { 5d c20c00 8b4510 33d2 } // n = 4, score = 200 // 5d | pop ebp // c20c00 | ret 0xc // 8b4510 | mov eax, dword ptr [ebp + 0x10] // 33d2 | xor edx, edx $sequence_9 = { 83c404 33db 8b450c 85c0 7402 8930 ff75fc } // n = 7, score = 200 // 83c404 | add esp, 4 // 33db | xor ebx, ebx // 8b450c | mov eax, dword ptr [ebp + 0xc] // 85c0 | test eax, eax // 7402 | je 4 // 8930 | mov dword ptr [eax], esi // ff75fc | push dword ptr [ebp - 4] condition: 7 of them and filesize < 65536 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY