malware_lodeinfo_pdb

YARA detection rule by JPCERT/CC Incident Response Group · NOASSERTION

LODEINFO malware

rule malware_lodeinfo_pdb {
    meta:
        description = "LODEINFO malware"
        author = "JPCERT/CC Incident Response Group"
        hash1 = "b50d83820a5704522fee59164d7bc69bea5c834ebd9be7fd8ad35b040910807f"
        hash2 = "d1ed97ebeba07120ffaeef5e19f13d027ef4f4a3f45135f63b6715388b3cf49e"
     strings:
		$pdb1 = "E:\\Production\\Tool-Developing\\"
        $pdb2 = "E:\\Production\\Tool-Developing\\png_info\\Release\\png_info.pdb"
        $func1 = "displayAsciiArt"
        $func2 = "displayChunkNames"
        $func3 = "displayFilterTypes"
        $func4 = "displayPNGInfo"
        $func5 = "get_shellcode"
        $docCMG = "BBB975150319031903190319"
     condition:
        (all of ($pdb*) or all of ($func*)) and uint16(0) == 0x5A4D or $docCMG
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

83221ad4-0343-4e24-bae2-1a802b08322f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion