16 lines
1.3 KiB
Plaintext
16 lines
1.3 KiB
Plaintext
|
|
rule Worm_Win32_Vobfus_F{
|
|
meta:
|
|
description = "Worm:Win32/Vobfus.F,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 06 00 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {4b ff ff 00 24 04 76 ff 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 68 00 03 00 6b 76 ff 1a 78 ff 1c 2f 00 00 04 fc c8 00 1d f4 00 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 7c 00 03 00 1a 78 ff 00 27 04 70 ff 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 60 00 03 00 3e 70 ff fd e7 08 00 ?? 00 1a 78 ff 00 20 f5 00 00 00 00 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 64 00 03 00 1a 78 ff } //15
|
|
$a_03_1 = {f4 58 fc 0d f5 00 00 00 00 04 ?? ?? ?? ?? [0-02] f4 59 fc 0d f5 01 00 00 00 04 ?? ?? ?? ?? [0-02] f4 59 fc 0d f5 02 00 00 00 04 ?? ?? ?? ?? [0-05] f4 59 } //8
|
|
$a_01_2 = {a9 f3 00 01 c1 e7 04 60 ff 9d fb 12 fc 0d } //5
|
|
$a_02_3 = {43 00 72 00 65 00 61 00 74 00 65 00 53 00 68 00 6f 00 72 00 74 00 63 00 75 00 74 00 00 00 00 00 (54 00 61 00 72 00 67 00 65 00 74 00 50 00 61 00 74 00 68 00|49 00 63 00 6f 00 6e 00 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00) 00 } //5
|
|
$a_00_4 = {77 73 6f 63 6b 33 32 00 0e 00 00 00 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 00 } //5
|
|
$a_00_5 = {50 72 6f 63 65 73 73 33 32 4e 65 78 74 00 } //5 牐捯獥㍳串硥t
|
|
condition:
|
|
((#a_02_0 & 1)*15+(#a_03_1 & 1)*8+(#a_01_2 & 1)*5+(#a_02_3 & 1)*5+(#a_00_4 & 1)*5+(#a_00_5 & 1)*5) >=23
|
|
|
|
} |