Themida_2xx

YARA detection rule by _pusher_ · GPL-2.0

Rule Themida_2xx (No description metadata provided).

import "pe"
rule Themida_2xx : Oreans Technologies
{
	meta:
		author="_pusher_"
		date = "2016-08"
	strings:
		$a0 = { E8 01 00 00 00 CC }
		$a1 = { 80 3B CC 0F 85 5F 00 00 00 }
		$a2 = { 80 3B CC 75 19 }
		
		$a3 = { 0F 85 51 FF FF FF 61 C9 C2 10 00 }
		$a4 = { EB F2 5E 59 5B 58 C9 C2 10 00 }
				$a5 = { EB F0 5E 59 5B 58 C9 C2 20 00 }
		$a6 = { 80 3B CC 75 19 C6 03 00 }
	condition:
				for any i in (0..pe.number_of_sections - 1):
		(  $a0 in (pe.sections[i].raw_data_offset..pe.sections[i].raw_data_offset+0x50)  )
		and ($a1 or $a2)
		and ($a3 or $a4 or $a5 or $a6)
		
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7db6434d-79b7-4b0c-844e-f1096357cba1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion