Create Maldoc_CVE-2017-0199.yar

Malicious_Documents/Maldoc_CVE-2017-0199.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+rule rtf_objdata_urlmoniker_http {
+meta:
+	ref = "https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/"
+ strings:
+ $header = "{\\rtf1"
+ $objdata = "objdata 0105000002000000" nocase
+ $urlmoniker = "E0C9EA79F9BACE118C8200AA004BA90B" nocase
+ $http = "68007400740070003a002f002f00" nocase
+ condition:
+ $header at 0 and $objdata and $urlmoniker and $http
+ }