16 lines
1.3 KiB
Plaintext
16 lines
1.3 KiB
Plaintext
|
|
rule Worm_Win32_Vobfus_F{
|
|
meta:
|
|
description = "Worm:Win32/Vobfus.F,SIGNATURE_TYPE_PEHSTR_EXT,17 00 17 00 06 00 00 0f 00 "
|
|
|
|
strings :
|
|
$a_02_0 = {4b ff ff 00 24 04 76 ff 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 68 00 03 00 6b 76 ff 1a 78 ff 1c 2f 00 00 04 fc c8 00 1d f4 00 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 7c 00 03 00 1a 78 ff 00 27 04 70 ff 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 60 00 03 00 3e 70 ff fd e7 08 00 90 01 01 00 1a 78 ff 00 20 f5 00 00 00 00 04 78 ff 05 00 00 24 01 00 0d 14 00 02 00 08 78 ff 0d 64 00 03 00 1a 78 ff 90 00 } //08 00
|
|
$a_03_1 = {f4 58 fc 0d f5 00 00 00 00 04 90 01 04 90 02 02 f4 59 fc 0d f5 01 00 00 00 04 90 01 04 90 02 02 f4 59 fc 0d f5 02 00 00 00 04 90 01 04 90 02 05 f4 59 90 00 } //05 00
|
|
$a_01_2 = {a9 f3 00 01 c1 e7 04 60 ff 9d fb 12 fc 0d } //05 00
|
|
$a_02_3 = {43 00 72 00 65 00 61 00 74 00 65 00 53 00 68 00 6f 00 72 00 74 00 63 00 75 00 74 00 00 00 00 00 90 03 14 18 54 00 61 00 72 00 67 00 65 00 74 00 50 00 61 00 74 00 68 00 49 00 63 00 6f 00 6e 00 4c 00 6f 00 63 00 61 00 74 00 69 00 6f 00 6e 00 00 90 00 } //05 00
|
|
$a_00_4 = {77 73 6f 63 6b 33 32 00 0e 00 00 00 67 65 74 68 6f 73 74 62 79 6e 61 6d 65 00 } //05 00
|
|
$a_00_5 = {50 72 6f 63 65 73 73 33 32 4e 65 78 74 00 } //00 00
|
|
condition:
|
|
any of ($a_*)
|
|
|
|
} |