= 7.0
76 | }
77 |
78 |
79 | rule HasOverlay : PECheck
80 | {
81 | meta:
82 | author="_pusher_"
83 | description = "Overlay Check"
84 | condition:
85 | // MZ signature at offset 0 and ...
86 | uint16(0) == 0x5A4D and
87 | // ... PE signature at offset stored in MZ header at 0x3C
88 | uint32(uint32(0x3C)) == 0x00004550 and
89 | //stupid check if last section is 0
90 | //not (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x0 and
91 |
92 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) < filesize
93 |
94 | }
95 |
96 | rule HasTaggantSignature : PECheck
97 | {
98 | meta:
99 | author="_pusher_"
100 | description = "TaggantSignature Check"
101 | date="2016-07"
102 | strings:
103 | $a0 = { 54 41 47 47 ?? ?? ?? ?? ?? ?? 00 00 ?? 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 09 30 07 06 05 2B 0E 03 02 1A 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 01 A0 82 ?? ?? 04 82 ?? ?? ?? 00 01 00 ?? ?? }
104 | //$c0 = { 06 09 2A 86 }
105 | condition:
106 | // MZ signature at offset 0 and ...
107 | uint16(0) == 0x5A4D and
108 | // ... PE signature at offset stored in MZ header at 0x3C
109 | uint32(uint32(0x3C)) == 0x00004550 and
110 | //TAGG+4E==packerid
111 | //(uint32be(@a0+0x4E) == 0x0B51D132) and
112 | //(uint32be(@a0+0x12) == 0x006092a86) and
113 | //(uint32be(@a0+0x12)) == uint32be(@c0) and
114 |
115 | //uint32be(@a0+0x04) < (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) and
116 | $a0
117 | }
118 |
119 |
120 | rule HasDigitalSignature : PECheck
121 | {
122 | meta:
123 | author="_pusher_"
124 | description = "DigitalSignature Check"
125 | date="2016-07"
126 | strings:
127 | //size check is wildcarded
128 | $a0 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 68 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 5A 30 58 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
129 | $a1 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0B 30 09 06 05 2B 0E 03 02 1A 05 00 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 ?? 30 ?? 30 ?? 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 ?? 03 01 00 A0 ?? A2 ?? 80 00 30 21 30 09 06 05 2B 0E 03 02 1A 05 00 04 14 }
130 | $a2 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0E 30 ?? 06 ?? ?? 86 48 86 F7 0D 02 05 05 00 30 67 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 59 30 57 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 20 30 0C 06 08 2A 86 48 86 F7 0D 02 05 05 00 04 }
131 | $a3 = { ?? ?? ?? ?? 00 02 02 00 30 82 ?? ?? 06 09 2A 86 48 86 F7 0D 01 07 02 A0 82 ?? ?? 30 82 ?? ?? 02 01 01 31 0F 30 ?? 06 ?? ?? 86 48 01 65 03 04 02 01 05 00 30 78 06 0A 2B 06 01 04 01 82 37 02 01 04 A0 6A 30 68 30 33 06 0A 2B 06 01 04 01 82 37 02 01 0F 30 25 03 01 00 A0 20 A2 1E 80 1C 00 3C 00 3C 00 3C 00 4F 00 62 00 73 00 6F 00 6C 00 65 00 74 00 65 00 3E 00 3E 00 3E 30 31 30 0D 06 09 60 86 48 01 65 03 04 02 01 05 00 04 }
132 | condition:
133 | // MZ signature at offset 0 and ...
134 | uint16(0) == 0x5A4D and
135 | // ... PE signature at offset stored in MZ header at 0x3C
136 | uint32(uint32(0x3C)) == 0x00004550 and
137 | (for any of ($a*) : ($ in ( (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size)..filesize)) )
138 | //its not always like this:
139 | //and uint32(@a0) == (filesize-(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size))
140 | }
141 |
142 | rule HasDebugData : PECheck
143 | {
144 | meta:
145 | author = "_pusher_"
146 | description = "DebugData Check"
147 | date="2016-07"
148 | condition:
149 | // MZ signature at offset 0 and ...
150 | uint16(0) == 0x5A4D and
151 | // ... PE signature at offset stored in MZ header at 0x3C
152 | uint32(uint32(0x3C)) == 0x00004550 and
153 | //orginal
154 | //((uint32(uint32(0x3C)+0xA8) >0x0) and (uint32be(uint32(0x3C)+0xAC) >0x0))
155 | //((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) x64/x32
156 | (IsPE32 or IsPE64) and
157 | ((uint32(uint32(0x3C)+0xA8+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0) and (uint32be(uint32(0x3C)+0xAC+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)) >0x0))
158 | }
159 |
160 | rule IsBeyondImageSize : PECheck
161 | {
162 | meta:
163 | author = "_pusher_"
164 | date = "2016-07"
165 | description = "Data Beyond ImageSize Check"
166 | condition:
167 | // MZ signature at offset 0 and ...
168 | uint16(0) == 0x5A4D and
169 | // ... PE signature at offset stored in MZ header at 0x3C
170 | uint32(uint32(0x3C)) == 0x00004550 and
171 | for any i in (0..pe.number_of_sections-1):
172 | (
173 | (pe.sections[i].virtual_address+pe.sections[i].virtual_size) > (uint32(uint32(0x3C)+0x50)) or
174 | (pe.sections[i].raw_data_offset+pe.sections[i].raw_data_size) > filesize
175 | )
176 | }
177 |
178 | rule ImportTableIsBad : PECheck
179 | {
180 | meta:
181 | author = "_pusher_ & mrexodia"
182 | date = "2016-07"
183 | description = "ImportTable Check"
184 | condition:
185 | // MZ signature at offset 0 and ...
186 | uint16(0) == 0x5A4D and
187 | // ... PE signature at offset stored in MZ header at 0x3C
188 | uint32(uint32(0x3C)) == 0x00004550 and
189 | (IsPE32 or IsPE64) and
190 | ( //Import_Table_RVA+Import_Data_Size .. cannot be outside imagesize
191 | ((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)))) > (uint32(uint32(0x3C)+0x50))
192 | or
193 | (((uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x84+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)))) == 0x0)
194 | //or
195 |
196 | //doest work
197 | //pe.imports("", "")
198 |
199 | //need to check if this is ok.. 15:06 2016-08-12
200 | //uint32( uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34)) == 0x408000
201 | //this works..
202 | //uint32(uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+uint32(uint32(0x3C)+0x34) == 0x408000
203 |
204 | //uint32be(uint32be(0x409000)) == 0x005A
205 | //pe.image_base
206 | //correct:
207 |
208 | //uint32(uint32(0x3C)+0x80)+pe.image_base == 0x408000
209 |
210 | //this works (file offset):
211 | //$a0 at 0x4000
212 | //this does not work rva:
213 | //$a0 at uint32(0x0408000)
214 |
215 | //(uint32(uint32(uint32(0x3C)+0x80)+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5))+pe.image_base) == 0x0)
216 |
217 | or
218 | //tiny PE files..
219 | (uint32(0x3C)+0x80+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) > filesize)
220 |
221 | //or
222 | //uint32(uint32(0x3C)+0x80) == 0x21000
223 | //uint32(uint32(uint32(0x3C)+0x80)) == 0x0
224 | //pe.imports("", "")
225 | )
226 | }
227 |
228 | rule ExportTableIsBad : PECheck
229 | {
230 | meta:
231 | author = "_pusher_ & mrexodia"
232 | date = "2016-07"
233 | description = "ExportTable Check"
234 | condition:
235 | // MZ signature at offset 0 and ...
236 | uint16(0) == 0x5A4D and
237 | // ... PE signature at offset stored in MZ header at 0x3C
238 | uint32(uint32(0x3C)) == 0x00004550 and
239 | (IsPE32 or IsPE64) and
240 | ( //Export_Table_RVA+Export_Data_Size .. cannot be outside imagesize
241 | ((uint32(uint32(0x3C)+0x78+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5) )) + (uint32(uint32(0x3C)+0x7C+((uint16(uint32(0x3C)+0x18) & 0x200) >> 5)))) > (uint32(uint32(0x3C)+0x50))
242 | )
243 | }
244 |
245 |
246 | rule HasModified_DOS_Message : PECheck
247 | {
248 | meta:
249 | author = "_pusher_"
250 | description = "DOS Message Check"
251 | date="2016-07"
252 | strings:
253 | $a0 = "This program must be run under Win32" wide ascii nocase
254 | $a1 = "This program cannot be run in DOS mode" wide ascii nocase
255 | //UniLink
256 | $a2 = "This program requires Win32" wide ascii nocase
257 | $a3 = "This program must be run under Win64" wide ascii nocase
258 | condition:
259 | // MZ signature at offset 0 and ...
260 | uint16(0) == 0x5A4D and
261 | // ... PE signature at offset stored in MZ header at 0x3C
262 | uint32(uint32(0x3C)) == 0x00004550 and not
263 | (for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
264 | }
265 |
266 | rule HasRichSignature : PECheck
267 | {
268 | meta:
269 | author = "_pusher_"
270 | description = "Rich Signature Check"
271 | date="2016-07"
272 | strings:
273 | $a0 = "Rich" ascii
274 | condition:
275 | // MZ signature at offset 0 and ...
276 | uint16(0) == 0x5A4D and
277 | // ... PE signature at offset stored in MZ header at 0x3C
278 | uint32(uint32(0x3C)) == 0x00004550 and
279 | (for any of ($a*) : ($ in (0x0..uint32(0x3c) )))
280 | }
281 |
282 | rule IsSuspicious
283 | {
284 | meta:
285 | author="_pusher_"
286 | date = "2016-07"
287 | description="Might be PE Virus"
288 | condition:
289 | uint32(0x20) == 0x20202020
290 | }
291 |
292 | rule IsGoLink
293 | {
294 | meta:
295 | author="_pusher_"
296 | date = "2016-08"
297 | description="www.GoDevTool.com"
298 | strings:
299 | $a0 = { 47 6F 4C 69 6E 6B }
300 | condition:
301 | // MZ signature at offset 0 and ...
302 | uint16(0) == 0x5A4D and
303 | // ... PE signature at offset stored in MZ header at 0x3C
304 | $a0 at 0x40
305 |
306 | }
307 |
308 |
309 | rule borland_cpp {
310 | meta:
311 | author = "_pusher_"
312 | description = "Borland C++"
313 | date = "2015-08"
314 | version = "0.1"
315 | strings:
316 | $c0 = { 59 5F 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
317 | $c1 = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 52 6A 00 E8 ?? ?? ?? ?? 8B D0 E8 ?? ?? ?? ?? 5A E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? 59 68 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
318 | $c2 = { 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? 6A 00 E9 ?? ?? ?? ?? E9 ?? ?? ?? ?? 33 C0 A0 ?? ?? ?? ?? C3 A1 ?? ?? ?? ?? C3 }
319 | condition:
320 | (
321 | //linker 2.25 and 5.00
322 | ((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or
323 | ((pe.linker_version.major == 5) and (pe.linker_version.minor == 0 ))
324 | ) and
325 | any of them
326 | }
327 |
328 | rule borland_delphi {
329 | meta:
330 | author = "_pusher_"
331 | description = "Borland Delphi 2.0 - 7.0 / 2005 - 2007"
332 | date = "2016-03"
333 | version = "0.2"
334 | strings:
335 | $c0 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? FF A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 }
336 | $c1 = { 53 8B D8 33 C0 A3 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 33 C0 A3 ?? ?? ?? ?? 8D 43 08 A3 ?? ?? ?? ?? E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 5B C3 }
337 | //some x64 version of delphi
338 | $c2 = { 53 48 83 EC 20 48 89 CB C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 48 33 C9 E8 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 8D 43 10 48 89 05 ?? ?? ?? ?? 48 8D 05 ?? FC FF FF 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 D9 48 8D 15 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 83 C4 20 5B C3 }
339 | //unusual delphi version unknown version (unpackme- FSG 1.31 - dulek)
340 | $c3 = { 50 6A 00 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 00 00 00 00 C7 42 0C 00 00 00 00 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
341 | //delphi2
342 | $c4 = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
343 | //delphi3
344 | $c5 = { 50 6A 00 E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 55 8B EC 33 C0 }
345 | //delphi5
346 | $c6 = { 50 6A ?? E8 ?? ?? FF FF BA ?? ?? ?? ?? 52 89 05 ?? ?? ?? ?? 89 42 04 C7 42 08 ?? ?? ?? ?? C7 42 0C ?? ?? ?? ?? E8 ?? ?? ?? ?? 5A 58 E8 ?? ?? ?? ?? C3 }
347 | condition:
348 | any of them
349 | and
350 | (
351 | //if its not linker 2.25 its been modified (unpacked usually)
352 | //unknown x64 build of delphi
353 | ((pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )) or ((pe.linker_version.major == 8) and (pe.linker_version.minor == 0 ))
354 | //unpacked files usually have this linker:
355 | or ((pe.linker_version.major == 0) and (pe.linker_version.minor == 0 )) )
356 | //could check for dvclal.. maybe too much
357 | }
358 |
359 | rule free_pascal {
360 | meta:
361 | author = "_pusher_"
362 | description = "Free Pascal"
363 | date = "2015-08"
364 | version = "0.1"
365 | strings:
366 | $c0 = { 55 89 E5 83 ?? ?? 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 }
367 | $c1 = { 55 89 E5 53 B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 80 3D ?? ?? ?? ?? 00 75 0C 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? A3 ?? ?? ?? ?? B8 }
368 | $c2 = { 55 89 E5 83 EC 04 89 5D FC B8 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A0 ?? ?? ?? ?? 84 C0 75 05 E8 ?? ?? ?? ?? C7 05 }
369 | condition:
370 | any of them
371 | }
372 |
373 | rule borland_delphi_dll {
374 | meta:
375 | author = "_pusher_"
376 | description = "Borland Delphi DLL"
377 | date = "2015-08"
378 | version = "0.1"
379 | info = "one is at entrypoint"
380 | strings:
381 | $c0 = { BA ?? ?? ?? ?? 83 7D 0C 01 75 ?? 50 52 C6 05 ?? ?? ?? ?? ?? 8B 4D 08 89 0D ?? ?? ?? ?? 89 4A 04 }
382 | $c1 = { 55 8B EC 83 C4 ?? B8 ?? ?? ?? ?? E8 ?? ?? FF FF E8 ?? ?? FF FF 8D 40 00 }
383 | condition:
384 | any of them
385 | }
386 |
387 | rule borland_component {
388 | meta:
389 | author = "_pusher_"
390 | description = "Borland Component"
391 | date = "2015-08"
392 | version = "0.1"
393 | strings:
394 | $c0 = { E9 ?? ?? ?? FF 8D 40 00 }
395 | condition:
396 | $c0 at pe.entry_point
397 | }
398 |
399 | rule PureBasic : Neil Hodgson
400 | {
401 | meta:
402 | author="_pusher_"
403 | date="2016-07"
404 | strings:
405 | //make check for msvrt.dll
406 | $c0 = { 55 8B EC 6A 00 68 00 10 00 00 6A ?? FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 00 00 00 00 C7 05 ?? ?? ?? ?? 10 00 00 00 A1 ?? ?? ?? ?? 50 6A ?? 8B 0D ?? ?? ?? ?? 51 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 5D C3 CC CC CC CC CC CC CC CC CC }
407 | $c1 = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
408 | $aa0 = "\x00MSVCRT.dll\x00" ascii
409 | $aa1 = "\x00CRTDLL.dll\x00" ascii
410 | condition:
411 | (for any of ($c0,$c1) : ( $ at pe.entry_point )) and
412 | (any of ($aa*) ) and
413 | ((pe.linker_version.major == 2) and (pe.linker_version.minor == 50 ))
414 | }
415 |
416 | rule PureBasicDLL : Neil Hodgson
417 | {
418 | meta:
419 | author="malware-lu"
420 | strings:
421 | $a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 ?? ?? ?? 10 E8 }
422 |
423 | condition:
424 | $a0 at pe.entry_point
425 | }
426 |
427 | rule PureBasic4xDLL : Neil Hodgson
428 | {
429 | meta:
430 | author="malware-lu"
431 | strings:
432 | $a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }
433 |
434 | condition:
435 | $a0 at pe.entry_point
436 | }
437 |
438 | rule SkDUndetectabler : SkDrat {
439 | meta:
440 | author = "_pusher_"
441 | condition:
442 | (
443 | borland_delphi or //check All FSG or
444 | ((pe.linker_version.major == 6) and (pe.linker_version.minor == 0 ))
445 | )
446 | and
447 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size < filesize) and
448 | //is overlay at offset 2A00,1A00,C00,745,739
449 | //pe.overlay & pe.overlay_size would have been prettier
450 | (
451 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000739) or
452 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000745) or
453 | //Uncompressed
454 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00000C00) or
455 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00002A00) or
456 | (pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size == 0x00001A00)
457 | )
458 | and
459 | //is xored MZ ?
460 | (
461 | uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x6275 or
462 | uint16(pe.sections[pe.number_of_sections-1].raw_data_offset+pe.sections[pe.number_of_sections-1].raw_data_size) == 0x4057
463 | )
464 | }
465 |
466 | /* usefull ? 18:53 2016-08-12
467 | rule MicrosoftVisualCV80
468 | {
469 | meta:
470 | author="malware-lu"
471 | strings:
472 | $a0 = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
473 |
474 | condition:
475 | $a0 at pe.entry_point
476 | }
477 | */
478 |
479 | rule Cygwin : Red Hat
480 | {
481 | meta:
482 | author = "_pusher_"
483 | date = "2016-07"
484 | strings:
485 | $a0 = "cygwin1.dll" ascii nocase
486 | $aa1 = "cygwin_internal"
487 | $aa2 = "cygwin_detach_dll"
488 | condition:
489 | (
490 | (pe.linker_version.major == 2) and (pe.linker_version.minor == 56 ) or
491 | (pe.linker_version.major == 2) and (pe.linker_version.minor == 24 ) or
492 | (pe.linker_version.major == 2) and (pe.linker_version.minor == 25 )
493 | )
494 | and
495 | ($a0 and (any of ($aa*) ))
496 | }
497 |
498 | rule MinGW_1
499 | {
500 | meta:
501 | author = "_pusher_"
502 | date = "2016-07"
503 | strings:
504 | $a0 = "msvcrt.dll" ascii nocase
505 | $aa1 = "Mingw-w64 runtime failure:"
506 | $aa2 = "-LIBGCCW32-EH-3-SJLJ-GTHR-MINGW32" wide ascii nocase
507 | $aa3 = "_mingw32_init_mainargs"
508 | //too wild ?
509 | $aa4 = "mingw32"
510 | $aa5 = "-LIBGCCW32-EH-2-SJLJ-GTHR-MINGW32" wide ascii nocase
511 | $aa6 = "-GCCLIBCYGMING-EH-TDM1-SJLJ-GTHR-MINGW32" wide ascii nocase
512 | $aa7 = "Mingw runtime failure:"
513 | condition:
514 | (
515 | (pe.linker_version.major == 2) and (pe.linker_version.minor == 56 ) or
516 | (pe.linker_version.major == 2) and ((pe.linker_version.minor >= 21) and (pe.linker_version.minor <= 25))
517 | )
518 | and
519 | ($a0 and (any of ($aa*) ))
520 | }
521 |
522 | rule FASM : flat assembler {
523 | //abit weak, needs more targets & testing
524 | meta:
525 | author = "_pusher_"
526 | date = "2016-01"
527 | description = "http://flatassembler.net"
528 | //strings:
529 | //$c0 = { 55 89 E5 83 EC 1C 8D 45 E4 6A 1C 50 FF 75 08 FF 15 ?? ?? ?? ?? 8B 45 E8 C9 C2 04 00 }
530 | condition:
531 | (
532 | //linker 1.60..1.79
533 | (pe.linker_version.major == 1) and ((pe.linker_version.minor >= 60) and (pe.linker_version.minor < 80))
534 | )
535 | //and $c0
536 | }
537 |
538 | rule AutoIt
539 | {
540 | meta:
541 | author = "_pusher_"
542 | date = "2016-07"
543 | description = "www.autoitscript.com/site/autoit/"
544 | strings:
545 | $aa0 = "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions. The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead. See the DllCall() documentation for details on changing the calling convention." wide ascii nocase
546 | $aa1 = "AutoIt Error" wide ascii nocase
547 | $aa2 = "Missing right bracket ')' in expression." wide ascii nocase
548 | $aa3 = "Missing operator in expression." wide ascii nocase
549 | $aa4 = "Unbalanced brackets in expression." wide ascii nocase
550 | $aa5 = "Error parsing function call." wide ascii nocase
551 |
552 | $aa6 = ">>>AUTOIT NO CMDEXECUTE<<<" wide ascii nocase
553 | $aa7 = "#requireadmin" wide ascii nocase
554 | $aa8 = "#OnAutoItStartRegister" wide ascii nocase
555 | $aa9 = "#notrayicon" wide ascii nocase
556 | $aa10 = "Cannot parse #include" wide ascii nocase
557 | condition:
558 | 5 of ($aa*)
559 | }
560 |
561 |
562 | rule PellesC : Pelle Orinius
563 | {
564 | meta:
565 | author = "_pusher_"
566 | date = "2016-08"
567 | description = "www.smorgasbordet.com/pellesc"
568 | strings:
569 | $aa0 = " -- terminating\x0D\x0A\x00 -- terminating\x0A\x00CRT: \x00unexpected error\x00" wide ascii nocase
570 | $aa1 = "unhandled exception (main)\x00unhandled exception in thread\x00unable to create thread\x00unable to destroy semaphore\x00" wide ascii nocase
571 | $aa2 = "unable to wait on semaphore\x00unable to post semaphore\x00unable to init semaphore\x00unable to unlock mutex\x00unable to lock mutex\x00unable to init mutex\x00" wide ascii nocase
572 | $aa3 = "invalid stream lock number\x00corrupt per-thread data\x00out of memory\x00unable to init threads\x00unable to init HEAP" wide ascii nocase
573 | condition:
574 | 3 of ($aa*) and
575 | (pe.linker_version.major == 2) and (pe.linker_version.minor == 50 )
576 | }
577 |
578 | rule QtFrameWork
579 | {
580 | meta:
581 | author="_pusher_"
582 | date="2016-08"
583 | strings:
584 | $aa0 = "\x00Qt5Core.dll\x00" ascii
585 | $aa1 = "\x00QtCore4.dll\x00" ascii
586 | condition:
587 | (any of ($aa*) )
588 | }
589 |
590 | /* usefull ? 18:32 2016-08-10
591 | rule masm32_tasm32
592 | {
593 | meta:
594 | author = "PEiD"
595 | description = "MASM32 / TASM32"
596 | group = "20"
597 | function = "0"
598 | strings:
599 | $a0 = { 6A ?? E8 ?? ?? ?? ?? A3 }
600 | condition:
601 | $a0
602 | }
603 | */
604 |
--------------------------------------------------------------------------------
/rules/Packers_index.yar:
--------------------------------------------------------------------------------
1 | /*
2 | Generated by Yara-Rules
3 | On 26-11-2019
4 | */
5 | include "./Packers/JJencode.yar"
6 | include "./Packers/Javascript_exploit_and_obfuscation.yar"
7 | include "./Packers/packer.yar"
8 | include "./Packers/packer_compiler_signatures.yar"
9 | include "./Packers/peid.yar"
10 |
--------------------------------------------------------------------------------
/yara_plugin.py:
--------------------------------------------------------------------------------
1 | import cutter
2 | import yara
3 |
4 | from PySide2.QtCore import QObject, SIGNAL
5 | from PySide2.QtWidgets import QAction, QLabel, QTableWidget, QTableWidgetItem, QAbstractItemView, QHeaderView
6 |
7 | class YaraDockWidget(cutter.CutterDockWidget):
8 | rule_filename = ''
9 | rule_basedir = 'rules'
10 | rules_changed = False
11 | def __init__(self, parent, action):
12 | """Initializes the widget gui."""
13 | super(YaraDockWidget, self).__init__(parent, action)
14 | self.setObjectName('Yara')
15 | self.setWindowTitle('Yara')
16 |
17 | self.table = QTableWidget(self)
18 | self.table.setShowGrid(False)
19 | self.table.verticalHeader().hide()
20 |
21 |
22 | self.table.setColumnCount(4)
23 |
24 | self.table.setHorizontalHeaderLabels(['File Offset', 'String Content', 'Rule', 'Filename'])
25 | self.table.resizeColumnsToContents()
26 | self.table.setEditTriggers(QAbstractItemView.NoEditTriggers)
27 | self.table.setSelectionBehavior(QAbstractItemView.SelectRows)
28 |
29 | self.table.horizontalHeader().setSectionResizeMode(2, QHeaderView.Stretch)
30 |
31 | self.setWidget(self.table)
32 |
33 | cutter.core().seekChanged.connect(self.update_contents)
34 | self.update_contents()
35 |
36 |
37 | def update_contents(self):
38 | """Scans the file with YARA rules from ./rules directory."""
39 | if not(self.rules_changed):
40 | self.table.setRowCount(0)
41 | filename = self.get_filename()
42 | try:
43 | import glob, os
44 | rules = [f for f in glob.glob('%s\\%s\\*.yar' % (os.path.dirname(os.path.abspath(__file__)), self.rule_basedir))]
45 | for rule in rules:
46 | rules = yara.compile(rule)
47 | self.rule_filename = rule.rsplit('\\', 1)[1]
48 | rules.match(filename, callback=self.mycallback)
49 | self.rules_changed = True
50 | except Exception as e:
51 | pass
52 |
53 | def get_filename(self):
54 | """Returns working project from Cutter pipe."""
55 | binary_information = cutter.cmdj('ij')
56 | filename = binary_information['core']['file']
57 | return filename
58 |
59 | def mycallback(self, data):
60 | """Populates the table with matching YARA rules."""
61 | if(data['matches']):
62 | for string in data['strings']:
63 |
64 | row_position = self.table.rowCount()
65 | self.table.insertRow(row_position)
66 |
67 | self.table.setItem(row_position, 0, QTableWidgetItem(str(string[0])))
68 | self.table.setItem(row_position, 1, QTableWidgetItem(str(string[2])))
69 | self.table.setItem(row_position, 2, QTableWidgetItem(data['rule']))
70 | self.table.setItem(row_position, 3, QTableWidgetItem(self.rule_filename))
71 |
72 | yara.CALLBACK_CONTINUE
73 |
74 |
75 | class MyCutterPlugin(cutter.CutterPlugin):
76 | name = 'Yara'
77 | description = 'Scan your Cutter project with Yara rules'
78 | version = '1.0'
79 | author = 'Jannis Kirschner'
80 |
81 | def setupPlugin(self):
82 | pass
83 |
84 | def setupInterface(self, main):
85 | action = QAction('Yara', main)
86 | action.setCheckable(True)
87 | widget = YaraDockWidget(main, action)
88 | main.addPluginDockWidget(widget, action)
89 |
90 | def terminate(self):
91 | pass
92 |
93 | def create_cutter_plugin():
94 | return MyCutterPlugin()
95 |
--------------------------------------------------------------------------------