This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license.
*/
import "pe"
import "math"
rule IsPE32 : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint16(uint32(0x3C)+0x18) == 0x010B
}
rule IsPE64 : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint16(uint32(0x3C)+0x18) == 0x020B
}
rule IsNET_EXE : PECheck
{
condition:
pe.imports ("mscoree.dll","_CorExeMain")
}
rule IsNET_DLL : PECheck
{
condition:
pe.imports ("mscoree.dll","_CorDllMain")
}
rule IsDLL : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
(uint16(uint32(0x3C)+0x16) & 0x2000) == 0x2000
}
rule IsConsole : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint16(uint32(0x3C)+0x5C) == 0x0003
}
rule IsWindowsGUI : PECheck
{
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint16(uint32(0x3C)+0x5C) == 0x0002
}
rule IsPacked : PECheck
{
meta:
description = "Entropy Check"
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550 and
math.entropy(0, filesize) >= 7.0
}
rule HasOverlay : PECheck
{
meta:
author="_pusher_"
description = "Overlay Check"
condition:
// MZ signature at offset 0 and ...
uint16(0) == 0x5A4D and
// ... PE signature at offset stored in MZ header at 0x3C
uint32(uint32(0x3C)) == 0x00004550 and
//stupid check if last section is 0
//not (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x0 and
(pe.linker_version.major == 1) and ((pe.linker_version.minor >= 60) and (pe.linker_version.minor < 80))
)
//and $c0
}
rule AutoIt
{
meta:
author = "_pusher_"
date = "2016-07"
description = "www.autoitscript.com/site/autoit/"
strings:
$aa0 = "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention." wide ascii nocase
$aa1 = "AutoIt Error" wide ascii nocase
$aa2 = "Missing right bracket ')' in expression." wide ascii nocase
$aa3 = "Missing operator in expression." wide ascii nocase
$aa4 = "Unbalanced brackets in expression." wide ascii nocase
$aa5 = "Error parsing function call." wide ascii nocase
$aa6 = ">>>AUTOIT NO CMDEXECUTE<<<" wide ascii nocase
$aa1 = "unhandled exception (main)\x00unhandled exception in thread\x00unable to create thread\x00unable to destroy semaphore\x00" wide ascii nocase
$aa2 = "unable to wait on semaphore\x00unable to post semaphore\x00unable to init semaphore\x00unable to unlock mutex\x00unable to lock mutex\x00unable to init mutex\x00" wide ascii nocase
$aa3 = "invalid stream lock number\x00corrupt per-thread data\x00out of memory\x00unable to init threads\x00unable to init HEAP" wide ascii nocase
condition:
3 of ($aa*) and
(pe.linker_version.major == 2) and (pe.linker_version.minor == 50 )
