There is no description at this point.
rule win_slub_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-08-05" version = "1" description = "Detects win.slub." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slub" malpedia_rule_date = "20220805" malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71" malpedia_version = "20220808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b86f0000000 badc020000 8b8ef4000000 eb11 8b866c010000 bae8020000 8b8e70010000 } // n = 7, score = 100 // 8b86f0000000 | mov eax, dword ptr [esi + 0xf0] // badc020000 | mov edx, 0x2dc // 8b8ef4000000 | mov ecx, dword ptr [esi + 0xf4] // eb11 | jmp 0x13 // 8b866c010000 | mov eax, dword ptr [esi + 0x16c] // bae8020000 | mov edx, 0x2e8 // 8b8e70010000 | mov ecx, dword ptr [esi + 0x170] $sequence_1 = { 8bcb e8???????? 807e6d00 746e 8bcb e8???????? 84c0 } // n = 7, score = 100 // 8bcb | mov ecx, ebx // e8???????? | // 807e6d00 | cmp byte ptr [esi + 0x6d], 0 // 746e | je 0x70 // 8bcb | mov ecx, ebx // e8???????? | // 84c0 | test al, al $sequence_2 = { 8d4dc8 c745fc08000000 e8???????? 8b03 2b45e8 034510 f6451401 } // n = 7, score = 100 // 8d4dc8 | lea ecx, [ebp - 0x38] // c745fc08000000 | mov dword ptr [ebp - 4], 8 // e8???????? | // 8b03 | mov eax, dword ptr [ebx] // 2b45e8 | sub eax, dword ptr [ebp - 0x18] // 034510 | add eax, dword ptr [ebp + 0x10] // f6451401 | test byte ptr [ebp + 0x14], 1 $sequence_3 = { 8b4210 83e117 894a0c 23c1 752f 8b07 c745fc0a000000 } // n = 7, score = 100 // 8b4210 | mov eax, dword ptr [edx + 0x10] // 83e117 | and ecx, 0x17 // 894a0c | mov dword ptr [edx + 0xc], ecx // 23c1 | and eax, ecx // 752f | jne 0x31 // 8b07 | mov eax, dword ptr [edi] // c745fc0a000000 | mov dword ptr [ebp - 4], 0xa $sequence_4 = { 8b7d08 7f21 7c0b 8b7dd8 3b7868 8b7d08 } // n = 6, score = 100 // 8b7d08 | mov edi, dword ptr [ebp + 8] // 7f21 | jg 0x23 // 7c0b | jl 0xd // 8b7dd8 | mov edi, dword ptr [ebp - 0x28] // 3b7868 | cmp edi, dword ptr [eax + 0x68] // 8b7d08 | mov edi, dword ptr [ebp + 8] $sequence_5 = { 837e2400 7507 c7462460338a00 55 68d01b0000 6a01 51 } // n = 7, score = 100 // 837e2400 | cmp dword ptr [esi + 0x24], 0 // 7507 | jne 9 // c7462460338a00 | mov dword ptr [esi + 0x24], 0x8a3360 // 55 | push ebp // 68d01b0000 | push 0x1bd0 // 6a01 | push 1 // 51 | push ecx $sequence_6 = { 5b 83c408 c3 81fa2b4e0000 0f8f77070000 0f842f070000 81c24bd8ffff } // n = 7, score = 100 // 5b | pop ebx // 83c408 | add esp, 8 // c3 | ret // 81fa2b4e0000 | cmp edx, 0x4e2b // 0f8f77070000 | jg 0x77d // 0f842f070000 | je 0x735 // 81c24bd8ffff | add edx, 0xffffd84b $sequence_7 = { e8???????? 8b85e0feffff 83c408 83785c10 8d4848 7202 8b09 } // n = 7, score = 100 // e8???????? | // 8b85e0feffff | mov eax, dword ptr [ebp - 0x120] // 83c408 | add esp, 8 // 83785c10 | cmp dword ptr [eax + 0x5c], 0x10 // 8d4848 | lea ecx, [eax + 0x48] // 7202 | jb 4 // 8b09 | mov ecx, dword ptr [ecx] $sequence_8 = { 7415 50 ff15???????? 83c404 894704 85c0 0f84a0000000 } // n = 7, score = 100 // 7415 | je 0x17 // 50 | push eax // ff15???????? | // 83c404 | add esp, 4 // 894704 | mov dword ptr [edi + 4], eax // 85c0 | test eax, eax // 0f84a0000000 | je 0xa6 $sequence_9 = { 8d6e70 898ee0000000 8bd9 ff30 894c2424 6a0a 51 } // n = 7, score = 100 // 8d6e70 | lea ebp, [esi + 0x70] // 898ee0000000 | mov dword ptr [esi + 0xe0], ecx // 8bd9 | mov ebx, ecx // ff30 | push dword ptr [eax] // 894c2424 | mov dword ptr [esp + 0x24], ecx // 6a0a | push 0xa // 51 | push ecx condition: 7 of them and filesize < 1785856 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY