DefenderYara/TrojanDownloader/O97M/JpgFetch/TrojanDownloader_O97M_JpgFetch_KA.yar

rule TrojanDownloader_O97M_JpgFetch_KA{
	meta:
		description = "TrojanDownloader:O97M/JpgFetch.KA,SIGNATURE_TYPE_MACROHSTR_EXT,03 00 03 00 05 00 00 02 00 "
		
	strings :
		$a_02_0 = {54 68 69 73 44 6f 63 75 6d 65 6e 74 2e 44 65 66 61 75 6c 74 54 61 72 67 65 74 46 72 61 6d 65 20 26 20 22 90 02 28 2e 6a 70 67 27 2c 20 20 27 25 41 50 50 44 41 54 41 25 5c 90 02 1e 2e 65 78 65 27 29 90 00 } //02 00 
		$a_02_1 = {54 68 69 73 44 6f 63 75 6d 65 6e 74 2e 44 65 66 61 75 6c 74 54 61 72 67 65 74 46 72 61 6d 65 20 26 20 22 90 02 28 2e 6a 70 67 27 2c 20 20 27 25 41 50 50 44 41 54 41 25 5c 90 02 1e 2e 6a 73 27 29 90 00 } //01 00 
		$a_00_2 = {3d 20 45 6e 76 69 72 6f 6e 28 22 41 50 50 44 41 54 41 22 29 20 26 20 22 5c 22 } //01 00  = Environ("APPDATA") & "\"
		$a_02_3 = {4f 70 65 6e 20 65 6e 76 20 26 20 22 90 02 20 22 20 26 20 22 2e 62 61 74 22 90 00 } //01 00 
		$a_00_4 = {41 74 74 72 69 62 75 74 65 20 56 42 5f 4e 61 6d 65 20 3d 20 22 4d 6f 64 65 6c 73 50 61 67 65 31 22 } //00 00  Attribute VB_Name = "ModelsPage1"
	condition:
		any of ($a_*)
 
}