SUSP_AdobePDF_SFX_Bitmap_Combo_Executable_RID362C

YARA detection rule by Florian Roth · CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/

Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon

import "pe"
rule SUSP_AdobePDF_SFX_Bitmap_Combo_Executable_RID362C : ANOMALY DEMO EXE FILE SUSP {
   meta:
      description = "Detects a suspicious executable that contains both a SFX icon and an Adobe PDF icon"
      author = "Florian Roth"
      reference = "https://mp.weixin.qq.com/s/3Pa3hiuZyQBspDzH0kGSHw"
      date = "2020-11-02 16:44:31"
      score = 60
      customer = "demo"
      license = "CC-BY-NC https://creativecommons.org/licenses/by-nc/4.0/"
      hash1 = "13655f536fac31e6c2eaa9e6e113ada2a0b5e2b50a93b6bbfc0aaadd670cde9b"
      tags = "ANOMALY, DEMO, EXE, FILE, SUSP"
      required_modules = "pe"
      minimum_yara = "3.5.0"
      
   strings:
      $sc1 = { FF 00 CC FF FF 00 99 FF FF 00 66 FF FF 00 33 FF FF 80 00 FF FF 80 FF CC FF 80 CC CC FF C0 99 CC FF 80 66 CC FF 00 33 CC FF 00 00 CC FF 00 FF 99 FF FF CC 99 FF FF 99 99 FF FF 66 99 FF FF 33 99 FF 08 00 99 FF 88 FF 66 FF 88 CC 66 FF 88 99 66 FF 88 66 66 FF 88 33 66 FF 05 00 66 FF 55 FF 33 FF 55 CC 33 FF 55 99 33 FF 55 66 33 FF 58 33 33 FF 01 00 33 FF 99 FF 00 FF 99 CC 00 FF 99 99 00 FF 99 66 00 FF 58 33 00 FF 01 00 00 FF 99 FF FF CC 99 CC FF CC 99 99 FF CC 99 66 FF CC 58 33 FF CC 01 00 FF CC FF FF CC CC FF CC CC CC FF 99 CC CC FF 66 CC CC 58 33 CC CC 01 00 CC CC FF FF 99 } 
      $sc2 = { 28 66 27 00 60 00 00 00 80 00 00 00 80 80 80 00 C0 C0 C0 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 FF FF FF 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 5D 33 00 00 } 
   condition: 
      uint16 ( 0 ) == 0x5a4d and all of them and pe.number_of_signatures < 1
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

024b22c0-797f-47c3-8ded-08393e27cacb

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion