win_unidentified_121_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.unidentified_121.

rule win_unidentified_121_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.unidentified_121."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_121"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 8b55fc 8b4518 89420c 8b4dfc 8b551c }
                                                                        
        $sequence_1 = { 807b0c5a 0f8578fdffff 4883c30d 31d2 }
                                                            
        $sequence_2 = { 8b55fc 8b4514 8a08 884a2d }
                                                            
        $sequence_3 = { 8b55fc 8b4518 894208 837dd401 }
                                                            
        $sequence_4 = { 31c0 b90a000000 488d35779e0000 f3a5 488d7c2448 b943000000 }
                                                                                    
        $sequence_5 = { 4e8d3c01 b920000000 f348ab c70700000000 0f8550010000 418b4114 }
                                                                                    
        $sequence_6 = { 750c 48837c242801 0f8675fbffff 85ff 0f89c1fbffff e8???????? }
                                                                                    
        $sequence_7 = { 8b55fc 8b451c 89422c 8b4dfc }
                                                            
        $sequence_8 = { 8b55fc 8b4518 668b08 66894a32 }
                                                            
        $sequence_9 = { 74ae 8b4338 3b433c 7da6 488b5330 }
                                                                        
        $sequence_10 = { 488d9424f0000000 4889d9 ff15???????? 31c9 ff15???????? 4531c9 4531c0 }
                                                                                                
        $sequence_11 = { 8b55fc 8b4518 894268 6a08 }
                                                            
        $sequence_12 = { 8b55fc 8b4520 894260 8b4dfc }
                                                            
        $sequence_13 = { 8b55fc 8b4514 8b4d18 894204 }
                                                            
        $sequence_14 = { 4889d7 4183fe01 4889d6 4519ed 4183e5fd 4183c51e 4183fe01 }
                                                                                                
        $sequence_15 = { 80fa09 0f8757ffffff 0fb65002 488d4802 }
                                                            
    condition:
        7 of them and filesize < 2419712
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4ee27cf0-9bd9-4822-a77b-850bb37c1bc5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion