Actor(s): Hellsing
There is no description at this point.
rule win_sisfader_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.sisfader." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sisfader" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 85c9 741f 33c0 85c9 7419 } // n = 5, score = 300 // 85c9 | test ecx, ecx // 741f | je 0x21 // 33c0 | xor eax, eax // 85c9 | test ecx, ecx // 7419 | je 0x1b $sequence_1 = { e8???????? 85c0 b91d000000 0f44d9 } // n = 4, score = 300 // e8???????? | // 85c0 | test eax, eax // b91d000000 | mov ecx, 0x1d // 0f44d9 | cmove ebx, ecx $sequence_2 = { c745d800000000 8b55fc 8b45d8 894214 8b4dfc } // n = 5, score = 200 // c745d800000000 | mov dword ptr [ebp - 0x28], 0 // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b45d8 | mov eax, dword ptr [ebp - 0x28] // 894214 | mov dword ptr [edx + 0x14], eax // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_3 = { 6a01 e8???????? 83c40c eb38 6a00 6a00 } // n = 6, score = 200 // 6a01 | push 1 // e8???????? | // 83c40c | add esp, 0xc // eb38 | jmp 0x3a // 6a00 | push 0 // 6a00 | push 0 $sequence_4 = { 41 3b4a04 72ee 8b4204 } // n = 4, score = 200 // 41 | inc ecx // 3b4a04 | cmp ecx, dword ptr [edx + 4] // 72ee | jb 0xfffffff0 // 8b4204 | mov eax, dword ptr [edx + 4] $sequence_5 = { e8???????? 8b442420 83c414 c74608e2e00000 } // n = 4, score = 200 // e8???????? | // 8b442420 | mov eax, dword ptr [esp + 0x20] // 83c414 | add esp, 0x14 // c74608e2e00000 | mov dword ptr [esi + 8], 0xe0e2 $sequence_6 = { c705????????20000000 c705????????00000000 6a01 6a00 6a02 } // n = 5, score = 200 // c705????????20000000 | // c705????????00000000 | // 6a01 | push 1 // 6a00 | push 0 // 6a02 | push 2 $sequence_7 = { 0fb78dae010000 6685c9 7411 6683f92e 7509 66399db0010000 7402 } // n = 7, score = 200 // 0fb78dae010000 | movzx ecx, word ptr [ebp + 0x1ae] // 6685c9 | test cx, cx // 7411 | je 0x13 // 6683f92e | cmp cx, 0x2e // 7509 | jne 0xb // 66399db0010000 | cmp word ptr [ebp + 0x1b0], bx // 7402 | je 4 $sequence_8 = { 7423 8d450c 50 8b4d08 51 } // n = 5, score = 200 // 7423 | je 0x25 // 8d450c | lea eax, [ebp + 0xc] // 50 | push eax // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 51 | push ecx $sequence_9 = { 6683bdcc0100002e 751c 0fb785ce010000 6685c0 7419 6683f82e 750a } // n = 7, score = 200 // 6683bdcc0100002e | cmp word ptr [ebp + 0x1cc], 0x2e // 751c | jne 0x1e // 0fb785ce010000 | movzx eax, word ptr [ebp + 0x1ce] // 6685c0 | test ax, ax // 7419 | je 0x1b // 6683f82e | cmp ax, 0x2e // 750a | jne 0xc $sequence_10 = { 837df000 7407 8d55e0 52 ff55f0 } // n = 5, score = 200 // 837df000 | cmp dword ptr [ebp - 0x10], 0 // 7407 | je 9 // 8d55e0 | lea edx, [ebp - 0x20] // 52 | push edx // ff55f0 | call dword ptr [ebp - 0x10] $sequence_11 = { 89442420 837c242001 7425 837c242002 7441 837c242003 } // n = 6, score = 200 // 89442420 | mov dword ptr [esp + 0x20], eax // 837c242001 | cmp dword ptr [esp + 0x20], 1 // 7425 | je 0x27 // 837c242002 | cmp dword ptr [esp + 0x20], 2 // 7441 | je 0x43 // 837c242003 | cmp dword ptr [esp + 0x20], 3 $sequence_12 = { 8d9700010000 894610 85d2 7422 8b4604 85c0 741b } // n = 7, score = 200 // 8d9700010000 | lea edx, [edi + 0x100] // 894610 | mov dword ptr [esi + 0x10], eax // 85d2 | test edx, edx // 7422 | je 0x24 // 8b4604 | mov eax, dword ptr [esi + 4] // 85c0 | test eax, eax // 741b | je 0x1d $sequence_13 = { 57 8b3d???????? 81c600010000 c745dcaaeeddff c745e4e1f00000 0f1145f0 } // n = 6, score = 200 // 57 | push edi // 8b3d???????? | // 81c600010000 | add esi, 0x100 // c745dcaaeeddff | mov dword ptr [ebp - 0x24], 0xffddeeaa // c745e4e1f00000 | mov dword ptr [ebp - 0x1c], 0xf0e1 // 0f1145f0 | movups xmmword ptr [ebp - 0x10], xmm0 $sequence_14 = { 837c242003 745d 837c242004 7479 837c242005 0f8480000000 e9???????? } // n = 7, score = 200 // 837c242003 | cmp dword ptr [esp + 0x20], 3 // 745d | je 0x5f // 837c242004 | cmp dword ptr [esp + 0x20], 4 // 7479 | je 0x7b // 837c242005 | cmp dword ptr [esp + 0x20], 5 // 0f8480000000 | je 0x86 // e9???????? | $sequence_15 = { 6a01 e8???????? 83c418 b842000000 } // n = 4, score = 200 // 6a01 | push 1 // e8???????? | // 83c418 | add esp, 0x18 // b842000000 | mov eax, 0x42 $sequence_16 = { c744245401000000 33c0 85c0 0f850fffffff } // n = 4, score = 200 // c744245401000000 | mov dword ptr [esp + 0x54], 1 // 33c0 | xor eax, eax // 85c0 | test eax, eax // 0f850fffffff | jne 0xffffff15 $sequence_17 = { 89470c 8b4108 894708 817908020f0000 0f8573010000 83790410 } // n = 6, score = 200 // 89470c | mov dword ptr [edi + 0xc], eax // 8b4108 | mov eax, dword ptr [ecx + 8] // 894708 | mov dword ptr [edi + 8], eax // 817908020f0000 | cmp dword ptr [ecx + 8], 0xf02 // 0f8573010000 | jne 0x179 // 83790410 | cmp dword ptr [ecx + 4], 0x10 $sequence_18 = { 6bc800 8b5510 0fb7440a40 85c0 7422 8d4dfc } // n = 6, score = 200 // 6bc800 | imul ecx, eax, 0 // 8b5510 | mov edx, dword ptr [ebp + 0x10] // 0fb7440a40 | movzx eax, word ptr [edx + ecx + 0x40] // 85c0 | test eax, eax // 7422 | je 0x24 // 8d4dfc | lea ecx, [ebp - 4] $sequence_19 = { ff15???????? c1e802 33db 898754010000 } // n = 4, score = 200 // ff15???????? | // c1e802 | shr eax, 2 // 33db | xor ebx, ebx // 898754010000 | mov dword ptr [edi + 0x154], eax $sequence_20 = { 8905???????? c705????????07000000 8b442438 8905???????? c705????????00000000 } // n = 5, score = 200 // 8905???????? | // c705????????07000000 | // 8b442438 | mov eax, dword ptr [esp + 0x38] // 8905???????? | // c705????????00000000 | $sequence_21 = { 8b442450 8906 8b442470 89442440 } // n = 4, score = 200 // 8b442450 | mov eax, dword ptr [esp + 0x50] // 8906 | mov dword ptr [esi], eax // 8b442470 | mov eax, dword ptr [esp + 0x70] // 89442440 | mov dword ptr [esp + 0x40], eax $sequence_22 = { b90e000000 ff15???????? 33c0 e9???????? e9???????? ff15???????? } // n = 6, score = 200 // b90e000000 | mov ecx, 0xe // ff15???????? | // 33c0 | xor eax, eax // e9???????? | // e9???????? | // ff15???????? | $sequence_23 = { 83c408 8945dc 8b45a4 50 8b4de0 } // n = 5, score = 200 // 83c408 | add esp, 8 // 8945dc | mov dword ptr [ebp - 0x24], eax // 8b45a4 | mov eax, dword ptr [ebp - 0x5c] // 50 | push eax // 8b4de0 | mov ecx, dword ptr [ebp - 0x20] $sequence_24 = { 89442450 837c245000 7405 e9???????? 83bc248000000000 7539 } // n = 6, score = 200 // 89442450 | mov dword ptr [esp + 0x50], eax // 837c245000 | cmp dword ptr [esp + 0x50], 0 // 7405 | je 7 // e9???????? | // 83bc248000000000 | cmp dword ptr [esp + 0x80], 0 // 7539 | jne 0x3b $sequence_25 = { ff9424b0000000 89842480000000 83bc248000000000 750d } // n = 4, score = 200 // ff9424b0000000 | call dword ptr [esp + 0xb0] // 89842480000000 | mov dword ptr [esp + 0x80], eax // 83bc248000000000 | cmp dword ptr [esp + 0x80], 0 // 750d | jne 0xf $sequence_26 = { 53 6a10 ff75fc ff15???????? 6a00 ff75fc } // n = 6, score = 200 // 53 | push ebx // 6a10 | push 0x10 // ff75fc | push dword ptr [ebp - 4] // ff15???????? | // 6a00 | push 0 // ff75fc | push dword ptr [ebp - 4] $sequence_27 = { ffd6 0f1005???????? 8bf8 8b4508 } // n = 4, score = 200 // ffd6 | call esi // 0f1005???????? | // 8bf8 | mov edi, eax // 8b4508 | mov eax, dword ptr [ebp + 8] $sequence_28 = { 33d2 b904000000 e8???????? 33c0 83f801 7425 baffffffff } // n = 7, score = 200 // 33d2 | xor edx, edx // b904000000 | mov ecx, 4 // e8???????? | // 33c0 | xor eax, eax // 83f801 | cmp eax, 1 // 7425 | je 0x27 // baffffffff | mov edx, 0xffffffff $sequence_29 = { e8???????? 8b442470 c74708e2e00000 0f1005???????? 894704 895f0c 0f114714 } // n = 7, score = 200 // e8???????? | // 8b442470 | mov eax, dword ptr [esp + 0x70] // c74708e2e00000 | mov dword ptr [edi + 8], 0xe0e2 // 0f1005???????? | // 894704 | mov dword ptr [edi + 4], eax // 895f0c | mov dword ptr [edi + 0xc], ebx // 0f114714 | movups xmmword ptr [edi + 0x14], xmm0 condition: 7 of them and filesize < 417792 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY