Trojan_Win32_EMSTestFile

YARA detection rule by roadwy

Trojan:Win32/EMSTestFile,SIGNATURE_TYPE_ARHSTR_EXT,0c 00 06 00 0d 00 00

rule Trojan_Win32_EMSTestFile{
	meta:
		description = "Trojan:Win32/EMSTestFile,SIGNATURE_TYPE_ARHSTR_EXT,0c 00 06 00 0d 00 00 "
		
	strings :
		$a_00_0 = {4d 53 20 41 56 41 53 20 45 6d 73 54 65 73 74 46 69 6c 65 } 		$a_00_1 = {49 6e 74 65 72 6e 61 6c 20 74 65 73 74 20 6f 6e 6c 79 2e 20 44 6f 20 6e 6f 74 20 64 69 73 74 72 69 62 75 74 65 20 6f 75 74 73 69 64 65 20 79 6f 75 72 20 74 65 61 6d 21 } 		$a_00_2 = {68 41 67 43 41 41 43 4a 42 6d 61 42 66 67 53 7a 31 77 2b 46 77 77 41 41 41 47 54 67 52 71 41 50 38 32 36 49 50 6d } 		$a_00_3 = {47 24 4d 66 5a 4d 53 72 4e 6b 48 4b 41 4d 4b 65 2d 2b 54 47 46 32 33 70 45 56 32 36 63 71 50 54 34 58 61 } 		$a_00_4 = {71 58 63 43 66 44 72 32 28 32 58 66 69 4d 72 6d 61 6c 24 44 2d 2d 28 4b 71 48 51 42 40 24 55 49 71 60 26 5b 64 4a 23 39 } 		$a_00_5 = {4a 65 40 66 70 28 4b 71 6c 6c 5b 24 56 6b 40 49 50 58 61 4e 48 65 23 6b 32 23 48 56 6b 59 4b 5a } 		$a_00_6 = {53 49 50 46 65 29 49 39 21 36 6b 25 2c 42 27 35 6c 72 25 61 31 48 5b 71 6a 6d 28 2a 4b } 		$a_00_7 = {64 26 58 6b 66 48 33 6c 36 4a 72 50 56 6a 5b 24 59 5a 2a 42 71 28 70 50 63 50 52 2d 62 6c 51 5a 62 } 		$a_00_8 = {48 56 4e 4f 41 26 40 52 31 21 63 50 21 43 36 53 2d 38 34 64 49 4b 6b 2b 26 69 33 71 34 4a 4b 71 44 64 29 23 34 55 41 47 34 } 		$a_00_9 = {2d 4d 5a 45 4c 43 72 30 30 6b 26 32 4e 4a 2a 6a 6b 38 21 2c 40 42 27 48 40 60 6b 6d 23 5a 31 60 2b 6b 69 23 5b 55 2d 23 59 } 		$a_00_10 = {39 4d 48 72 4b 36 6d 5a 45 62 55 42 44 26 58 40 65 2a 7a 50 26 5b 41 34 51 4d 61 40 43 40 26 70 } 		$a_00_11 = {49 6d 59 71 6a 52 72 52 6d 52 69 72 6d 5b 6d 49 33 72 5a 61 32 63 49 6a 49 65 42 52 6a 49 62 48 24 49 31 61 49 63 49 69 69 5a } 		$a_00_12 = {4d 6a 4e 73 52 63 70 54 30 4e 44 24 66 63 61 62 47 21 38 28 4d 29 29 35 47 70 44 49 47 4b 50 56 5a } 	condition:
		((#a_00_0  & 1)*1+(#a_00_1  & 1)*1+(#a_00_2  & 1)*1+(#a_00_3  & 1)*1+(#a_00_4  & 1)*1+(#a_00_5  & 1)*1+(#a_00_6  & 1)*1+(#a_00_7  & 1)*1+(#a_00_8  & 1)*1+(#a_00_9  & 1)*1+(#a_00_10  & 1)*1+(#a_00_11  & 1)*1+(#a_00_12  & 1)*1) >=6
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0c93e0b5-9c41-4b06-a24c-d5542a6cd413

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion