malware_Doraemon

YARA detection rule by JPCERT/CC Incident Response Group · NOASSERTION

detect Doraemon

import "pe"
rule malware_Doraemon {
    meta:
      description = "detect Doraemon"
      author = "JPCERT/CC Incident Response Group"
      hash1 = "2d3699607194d1a2a6c1eeeb5d0e5e5e385b78d94d5053e38e3c1908c5ced1c6"
      hash2 = "95aa15baeef978b99e63a406fa06a1197f6f762047f9729f17bb49b72ead6477"
	  
    strings:
      
      $mut1 = {?? ?? ?? ?? 64 00 6F 00 ?? ?? ?? ?? 72 00 61 00 ?? ?? ?? ?? 65 00 6D 00 ?? ?? ?? ?? 6F 00 6E 00}

      
      $xorfunc = {42 8B 04 02 4D 8D 40 04 41 31 40 FC}

      
      $doubleNum1 = {9A 99 99 99 99 99 F1 3F}
	  
      
      $str1 = "Doraemon.dll" fullword ascii

    condition:
	  (uint16(0) == 0x5A4D)
	  and (filesize < 1MB)
	  and pe.imports("gdi32.dll", "BitBlt")
	  and pe.imports("kernel32.dll", "EncodePointer")
	  and pe.imports("kernel32.dll", "ReadConsoleW")
	  and pe.imports("kernel32.dll", "ReadConsoleW")
	  and (pe.characteristics & pe.DLL)
	  and all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5410c9e9-c416-4692-bec0-6fc4ac3141e2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion