Initial rule set

antidebug.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+import "pe"
+
+rule DebuggerCheck__API : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="IsDebuggerPresent"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__PEB : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="IsDebugged"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__GlobalFlags : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="NtGlobalFlags"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__QueryInfo : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="QueryInformationProcess"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__RemoteAPI : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="CheckRemoteDebuggerPresent"
+	condition:
+		any of them
+}
+
+rule DebuggerHiding__Thread : AntiDebug DebuggerHiding {
+	meta:
+	    Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+		weight = 1
+	strings:
+		$ ="SetInformationThread"
+	condition:
+		any of them
+}
+
+rule DebuggerHiding__Active : AntiDebug DebuggerHiding {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="DebugActiveProcess"
+	condition:
+		any of them
+}
+
+rule DebuggerTiming__PerformanceCounter : AntiDebug DebuggerTiming {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="QueryPerformanceCounter"
+	condition:
+		any of them
+}
+
+rule DebuggerTiming__Ticks : AntiDebug DebuggerTiming {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="GetTickCount"
+	condition:
+		any of them
+}
+
+rule DebuggerOutput__String : AntiDebug DebuggerOutput {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="OutputDebugString"
+	condition:
+		any of them
+}
+
+rule DebuggerException__UnhandledFilter : AntiDebug DebuggerException {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="SetUnhandledExceptionFilter"
+	condition:
+		any of them
+}
+
+rule DebuggerException__ConsoleCtrl : AntiDebug DebuggerException {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="GenerateConsoleCtrlEvent"
+	condition:
+		any of them
+}
+
+rule DebuggerException__SetConsoleCtrl : AntiDebug DebuggerException {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="SetConsoleCtrlHandler"
+	condition:
+		any of them
+}
+
+rule ThreadControl__Context : AntiDebug ThreadControl {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="SetThreadContext"
+	condition:
+		any of them
+}
+
+rule DebuggerCheck__DrWatson : AntiDebug DebuggerCheck {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ ="__invoke__watson"
+	condition:
+		any of them
+}
+
+rule SEH__v3 : AntiDebug SEH {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = "____except__handler3"
+		$ = "____local__unwind3"
+	condition:
+		any of them
+}
+
+rule SEH__v4 : AntiDebug SEH {
+    // VS 8.0+
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = "____except__handler4"
+		$ = "____local__unwind4"
+		$ = "__XcptFilter"
+	condition:
+		any of them
+}
+
+rule SEH__vba : AntiDebug SEH {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = "vbaExceptHandler"
+	condition:
+		any of them
+}
+
+rule SEH__vectored : AntiDebug SEH {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = "AddVectoredExceptionHandler"
+		$ = "RemoveVectoredExceptionHandler"
+	condition:
+		any of them
+}
+
+
+rule DebuggerPattern__RDTSC : AntiDebug DebuggerPattern {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = {0F 31}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__CPUID : AntiDebug DebuggerPattern {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = {0F A2}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__SEH_Saves : AntiDebug DebuggerPattern {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = {64 ff 35 00 00 00 00}
+	condition:
+		any of them
+}
+
+rule DebuggerPattern__SEH_Inits : AntiDebug DebuggerPattern {
+	meta:
+		weight = 1
+		Author = "naxonez"
+		reference = "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
+	strings:
+		$ = {64 89 25 00 00 00 00}
+	condition:
+		any of them
+}
+
+
+rule Check_Dlls
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for common sandbox dlls"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$dll1 = "sbiedll.dll" wide nocase ascii fullword
+		$dll2 = "dbghelp.dll" wide nocase ascii fullword
+		$dll3 = "api_log.dll" wide nocase ascii fullword
+		$dll4 = "dir_watch.dll" wide nocase ascii fullword
+		$dll5 = "pstorec.dll" wide nocase ascii fullword
+		$dll6 = "vmcheck.dll" wide nocase ascii fullword
+		$dll7 = "wpespy.dll" wide nocase ascii fullword
+	condition:
+		2 of them
+}
+
+rule Check_Qemu_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for QEMU systembiosversion key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
+
+rule Check_Qemu_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for Qemu reg keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "QEMU" wide nocase ascii
+	condition:
+		all of them
+}
+
+rule Check_VBox_Description
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox description reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "SystemBiosVersion" nocase wide ascii
+		$data = "VBOX" nocase wide ascii		
+	condition:
+		all of them
+}
+rule Check_VBox_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks Vbox registry keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
+		$value = "Identifier" nocase wide ascii
+		$data = "VBOX" nocase wide ascii
+	condition:
+		all of them
+}
+rule Check_VBox_Guest_Additions
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of the guest additions registry key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "SOFTWARE\\Oracle\\VirtualBox Guest Additions" wide ascii nocase
+	condition:
+		any of them	
+}
+rule Check_VBox_VideoDrivers
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for reg keys of Vbox video drivers"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\Description\\System" nocase wide ascii
+		$value = "VideoBiosVersion" wide nocase ascii
+		$data = "VIRTUALBOX" nocase wide ascii
+	condition:
+		all of them
+}
+rule Check_VMWare_DeviceMap
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmWare Registry Keys"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$key = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" wide ascii nocase
+		$value = "Identifier" wide nocase ascii
+		$data = "VMware" wide nocase ascii
+	condition:
+		all of them
+}
+rule Check_VmTools
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of VmTools reg key"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$ ="SOFTWARE\\VMware, Inc.\\VMware Tools" nocase ascii wide
+	condition:
+		any of them
+}
+rule Check_Wine
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for the existence of Wine"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$ ="wine_get_unix_file_name"
+	condition:
+		any of them
+}
+
+rule vmdetect
+{
+    meta:
+        author = "nex"
+        description = "Possibly employs anti-virtualization techniques"
+
+    strings:
+        // Binary tricks
+        $vmware = {56 4D 58 68}
+        $virtualpc = {0F 3F 07 0B}
+        $ssexy = {66 0F 70 ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F DB ?? ?? ?? ?? ?? 66 0F EF}
+        $vmcheckdll = {45 C7 00 01}
+        $redpill = {0F 01 0D 00 00 00 00 C3}
+
+        // Random strings
+        $vmware1 = "VMXh"
+        $vmware2 = "Ven_VMware_" nocase
+        $vmware3 = "Prod_VMware_Virtual_" nocase
+        $vmware4 = "hgfs.sys" nocase
+        $vmware5 = "mhgfs.sys" nocase
+        $vmware6 = "prleth.sys" nocase
+        $vmware7 = "prlfs.sys" nocase
+        $vmware8 = "prlmouse.sys" nocase
+        $vmware9 = "prlvideo.sys" nocase
+        $vmware10 = "prl_pv32.sys" nocase
+        $vmware11 = "vpc-s3.sys" nocase
+        $vmware12 = "vmsrvc.sys" nocase
+        $vmware13 = "vmx86.sys" nocase
+        $vmware14 = "vmnet.sys" nocase
+        $vmware15 = "vmicheartbeat" nocase
+        $vmware16 = "vmicvss" nocase
+        $vmware17 = "vmicshutdown" nocase
+        $vmware18 = "vmicexchange" nocase
+        $vmware19 = "vmdebug" nocase
+        $vmware20 = "vmmouse" nocase
+        $vmware21 = "vmtools" nocase
+        $vmware22 = "VMMEMCTL" nocase
+        $vmware23 = "vmx86" nocase
+        $vmware24 = "vmware" nocase
+        $virtualpc1 = "vpcbus" nocase
+        $virtualpc2 = "vpc-s3" nocase
+        $virtualpc3 = "vpcuhub" nocase
+        $virtualpc4 = "msvmmouf" nocase
+        $xen1 = "xenevtchn" nocase
+        $xen2 = "xennet" nocase
+        $xen3 = "xennet6" nocase
+        $xen4 = "xensvc" nocase
+        $xen5 = "xenvdb" nocase
+        $xen6 = "XenVMM" nocase
+        $virtualbox1 = "VBoxHook.dll" nocase
+        $virtualbox2 = "VBoxService" nocase
+        $virtualbox3 = "VBoxTray" nocase
+        $virtualbox4 = "VBoxMouse" nocase
+        $virtualbox5 = "VBoxGuest" nocase
+        $virtualbox6 = "VBoxSF" nocase
+        $virtualbox7 = "VBoxGuestAdditions" nocase
+        $virtualbox8 = "VBOX HARDDISK"  nocase
+
+        // MAC addresses
+        $vmware_mac_1a = "00-05-69"
+        $vmware_mac_1b = "00:05:69"
+        $vmware_mac_1c = "000569"
+        $vmware_mac_2a = "00-50-56"
+        $vmware_mac_2b = "00:50:56"
+        $vmware_mac_2c = "005056"
+        $vmware_mac_3a = "00-0C-29" nocase
+        $vmware_mac_3b = "00:0C:29" nocase
+        $vmware_mac_3c = "000C29" nocase
+        $vmware_mac_4a = "00-1C-14" nocase
+        $vmware_mac_4b = "00:1C:14" nocase
+        $vmware_mac_4c = "001C14" nocase
+        $virtualbox_mac_1a = "08-00-27"
+        $virtualbox_mac_1b = "08:00:27"
+        $virtualbox_mac_1c = "080027"
+
+    condition:
+        any of them
+}
+
+rule Check_Debugger
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for both isDebuggerPresent and CheckRemoteDebuggerPresent"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	condition:
+		pe.imports("kernel32.dll","CheckRemoteDebuggerPresent") and 
+		pe.imports("kernel32.dll","IsDebuggerPresent")
+}
+
+rule Check_DriveSize
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Rule tries to catch uses of DeviceIOControl being used to get the drive size"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+
+	strings:
+		$physicaldrive = "\\\\.\\PhysicalDrive0" wide ascii nocase
+		$dwIoControlCode = {68 5c 40 07 00 [0-5] FF 15} //push 7405ch ; push esi (handle) then call deviceoiocontrol IOCTL_DISK_GET_LENGTH_INFO	
+	condition:
+		pe.imports("kernel32.dll","CreateFileA") and 	
+		pe.imports("kernel32.dll","DeviceIoControl") and 
+		$dwIoControlCode and
+		$physicaldrive
+}
+rule Check_FilePaths
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Checks for filepaths containing popular sandbox names"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings: 
+		$path1 = "SANDBOX" wide ascii
+		$path2 = "\\SAMPLE" wide ascii
+		$path3 = "\\VIRUS" wide ascii
+	condition:
+		all of ($path*) and pe.imports("kernel32.dll","GetModuleFileNameA")
+}
+
+rule Check_UserNames
+{
+	meta:
+		Author = "Nick Hoffman"
+		Description = "Looks for malware checking for common sandbox usernames"
+		Sample = "de1af0e97e94859d372be7fcf3a5daa5"
+	strings:
+		$user1 = "MALTEST" wide ascii
+		$user2 = "TEQUILABOOMBOOM" wide ascii
+		$user3 = "SANDBOX" wide ascii
+		$user4 = "VIRUS" wide ascii
+		$user5 = "MALWARE" wide ascii
+	condition:
+		all of ($user*)  and pe.imports("advapi32.dll","GetUserNameA")
+}
+
+
+
+
+

crypto.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule BLOWFISH_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for Blowfish constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { D1310BA6 }
+		$c1 = { A60B31D1 }	
+		$c2 = { 98DFB5AC }
+		$c3 = { ACB5DF98 }
+		$c4 = { 2FFD72DB }
+		$c5 = { DB72FD2F }
+		$c6 = { D01ADFB7 }
+		$c7 = { B7DF1AD0 }
+		$c8 = { 4B7A70E9 }
+		$c9 = { E9707A4B }
+		$c10 = { F64C261C }
+		$c11 = { 1C264CF6 }
+	condition:
+                6 of them
+}
+
+rule MD5_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for MD5 constants"
+                date = "2014-01"
+                version = "0.2"
+        strings:
+		// Init constants
+		$c0 = { 67452301 }
+		$c1 = { efcdab89 }
+		$c2 = { 98badcfe }
+		$c3 = { 10325476 }
+		$c4 = { 01234567 }
+		$c5 = { 89ABCDEF }
+		$c6 = { FEDCBA98 }
+		$c7 = { 76543210 }	
+		// Round 2
+		$c8 = { F4D50d87 }
+		$c9 = { 78A46AD7 }
+	condition:
+                5 of them
+}
+
+rule RC6_Constants {
+        meta:
+                author = "chort (@chort0)"
+                description = "Look for RC6 magic constants in binary"
+                reference = "https://twitter.com/mikko/status/417620511397400576"
+                reference2 = "https://twitter.com/dyngnosis/status/418105168517804033"
+                date = "2013-12"
+                version = "0.2"
+        strings:
+                $c1 = { B7E15163 }
+                $c2 = { 9E3779B9 }
+                $c3 = { 6351E1B7 }
+                $c4 = { B979379E }
+        condition:
+                2 of them
+}
+
+rule RIPEMD160_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for RIPEMD-160 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+		5 of them
+}
+rule SHA1_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA1 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 67452301 }
+		$c1 = { EFCDAB89 }
+		$c2 = { 98BADCFE }
+		$c3 = { 10325476 }
+		$c4 = { C3D2E1F0 }
+		$c5 = { 01234567 }
+		$c6 = { 89ABCDEF }
+		$c7 = { FEDCBA98 }
+		$c8 = { 76543210 }
+		$c9 = { F0E1D2C3 }
+	condition:
+                5 of them
+}
+
+rule SHA512_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for SHA384/SHA512 constants"
+                date = "2014-01"
+                version = "0.1"
+        strings:
+		$c0 = { 428a2f98 }
+		$c1 = { 982F8A42 }
+		$c2 = { 71374491 }
+		$c3 = { 91443771 }
+		$c4 = { B5C0FBCF }
+		$c5 = { CFFBC0B5 }
+		$c6 = { E9B5DBA5 }
+		$c7 = { A5DBB5E9 }
+		$c8 = { D728AE22 }
+		$c9 = { 22AE28D7 }
+	condition:
+		5 of them
+}
+
+rule WHIRLPOOL_Constants {
+        meta:
+                author = "phoul (@phoul)"
+                description = "Look for WhirlPool constants"
+                date = "2014-02"
+                version = "0.1"
+        strings:
+		$c0 = { 18186018c07830d8 }
+		$c1 = { d83078c018601818 }
+		$c2 = { 23238c2305af4626 }
+		$c3 = { 2646af05238c2323 }
+	condition:
+                2 of them
+}
+
+

malicious_document.yar

+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+
+rule maldoc_API_hashing
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {AC 84 C0 74 07 C1 CF 0D 01 C7 EB F4 81 FF}
+        $a2 = {AC 84 C0 74 07 C1 CF 07 01 C7 EB F4 81 FF}
+    condition:
+        any of them
+}
+
+rule maldoc_function_prolog_signature
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {55 8B EC 81 EC}
+        $a2 = {55 8B EC 83 C4}
+        $a3 = {55 8B EC E8}
+        $a4 = {55 8B EC E9}
+        $a5 = {55 8B EC EB}
+    condition:
+        any of them
+}
+
+rule maldoc_structured_exception_handling
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 00 00 00 00}
+        $a2 = {64 A1 00 00 00 00}
+    condition:
+        any of them
+}
+
+rule maldoc_indirect_function_call_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF 75 ?? FF 55 ??}
+    condition:
+        for any i in (1..#a): (uint8(@a[i] + 2) == uint8(@a[i] + 5))
+}
+
+rule maldoc_indirect_function_call_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B5 ?? ?? ?? ?? FF 95 ?? ?? ?? ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 2) == uint8(@a[i] + 8)) and (uint8(@a[i] + 3) == uint8(@a[i] + 9)) and (uint8(@a[i] + 4) == uint8(@a[i] + 10)) and (uint8(@a[i] + 5) == uint8(@a[i] + 11)))
+}
+
+rule maldoc_indirect_function_call_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {FF B7 ?? ?? ?? ?? FF 57 ??}
+    condition:
+        $a
+}
+
+rule maldoc_find_kernel32_base_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {64 8B (05|0D|15|1D|25|2D|35|3D) 30 00 00 00}
+        $a2 = {64 A1 30 00 00 00}
+    condition:
+        any of them
+}
+
+rule maldoc_find_kernel32_base_method_2
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {31 ?? ?? 30 64 8B ??}
+    condition:
+        for any i in (1..#a): ((uint8(@a[i] + 1) >= 0xC0) and (((uint8(@a[i] + 1) & 0x38) >> 3) == (uint8(@a[i] + 1) & 0x07)) and ((uint8(@a[i] + 2) & 0xF8) == 0xA0) and (uint8(@a[i] + 6) <= 0x3F) and (((uint8(@a[i] + 6) & 0x38) >> 3) != (uint8(@a[i] + 6) & 0x07)))
+}
+
+rule maldoc_find_kernel32_base_method_3
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {68 30 00 00 00 (58|59|5A|5B|5C|5D|5E|5F) 64 8B ??}
+    condition:
+        for any i in (1..#a): (((uint8(@a[i] + 5) & 0x07) == (uint8(@a[i] + 8) & 0x07)) and (uint8(@a[i] + 8) <= 0x3F) and (((uint8(@a[i] + 8) & 0x38) >> 3) != (uint8(@a[i] + 8) & 0x07)))
+}
+
+rule maldoc_getEIP_method_1
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {E8 00 00 00 00 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        $a
+}
+
+rule maldoc_getEIP_method_4
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a1 = {D9 EE D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+        $a2 = {D9 EE 9B D9 74 24 F4 (58|59|5A|5B|5C|5D|5E|5F)}
+    condition:
+        any of them
+}
+
+rule maldoc_OLE_file_magic_number
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a = {D0 CF 11 E0}
+    condition:
+        $a
+}
+
+rule maldoc_suspicious_strings
+{
+    meta:
+        author = "Didier Stevens (https://DidierStevens.com)"
+    strings:
+        $a01 = "CloseHandle"
+        $a02 = "CreateFile"
+        $a03 = "GetProcAddr"
+        $a04 = "GetSystemDirectory"
+        $a05 = "GetTempPath"
+        $a06 = "GetWindowsDirectory"
+        $a07 = "IsBadReadPtr"
+        $a08 = "IsBadWritePtr"
+        $a09 = "LoadLibrary"
+        $a10 = "ReadFile"
+        $a11 = "SetFilePointer"
+        $a12 = "ShellExecute"
+        $a13 = "UrlDownloadToFile"
+        $a14 = "VirtualAlloc"
+        $a15 = "WinExec"
+        $a16 = "WriteFile"
+    condition:
+        any of them
+}