infected_08_27_18_phishing_english_error

YARA detection rule by Brian Laskowski · GPL-2.0

english - file error.php

rule infected_08_27_18_phishing_english_error {
  meta:
    description = "english - file error.php"
    author      = "Brian Laskowski"
    reference   = "https://github.com/Hestat/lw-yara/"
    date        = "2018-08-28"
    hash1       = "8eb8a7579fc8bc3b9bbad555e93acb58b8eb5eca935c4a645422e7db541bf02b"

  strings:
    $s1  = "<input type=\"hidden\" name=\"login\" value=\"<?php echo $_GET['email']; ?>\">" fullword ascii
    $s2  = "$domain = getDomainFromEmail($login);" fullword ascii
    $s3  = "$loginID = getloginIDFromlogin($login);" fullword ascii
    $s4  = "function getloginIDFromlogin($email)" fullword ascii
    $s5  = "$login = $_GET['email'];" fullword ascii
    $s6  = "$loginID = substr($email, 0, $pos);" fullword ascii
    $s7  = "$ln = strlen($login);" fullword ascii
    $s8  = "$len = strrev($login);" fullword ascii
    $s9  = "return $loginID;" fullword ascii
    $s10 = "6f%7a%2d%62%6f%72%64%65%72%2d%72%61%64%69%75%73%3a%20%34%70%78%3b%20%2d%77%65%62%6b%69%74%2d%62%6f%72%64%65%72%2d%72%61%64%69%75" ascii  
    $s11 = "20%33%70%78%20%23%30%30%30%3b%20%2d%77%65%62%6b%69%74%2d%62%6f%78%2d%73%68%61%64%6f%77%3a%20%33%70%78%20%33%70%78%20%33%70%78%20" ascii  
    $s12 = "20%32%70%78%3b%20%2d%77%65%62%6b%69%74%2d%62%6f%72%64%65%72%2d%72%61%64%69%75%73%3a%20%32%70%78%3b%20%2d%6b%68%74%6d%6c%2d%62%6f" ascii  
    $s13 = "78%2d%73%68%61%64%6f%77%3a%20%33%70%78%20%33%70%78%20%33%70%78%20%23%30%30%30%3b%20%2d%77%65%62%6b%69%74%2d%62%6f%78%2d%73%68%61" ascii  
    $s14 = "3a%34%35%70%78%3b%20%62%61%63%6b%67%72%6f%75%6e%64%2d%63%6f%6c%6f%72%3a%20%23%30%42%32%31%36%31%3b%20%62%6f%72%64%65%72%3a%20%73" ascii  
    $s15 = "20%34%70%78%3b%20%2d%6b%68%74%6d%6c%2d%62%6f%72%64%65%72%2d%72%61%64%69%75%73%3a%20%34%70%78%3b%20%62%6f%72%64%65%72%2d%72%61%64" ascii  
    $s16 = "2d%62%6f%78%2d%73%68%61%64%6f%77%3a%20%33%70%78%20%33%70%78%20%33%70%78%20%23%30%30%30%3b%20%62%6f%78%2d%73%68%61%64%6f%77%3a%20" ascii  
    $s17 = "79%3a%20%56%65%72%64%61%6e%61%3b%20%66%6f%6e%74%2d%73%69%7a%65%3a%20%31%32%70%78%3b%20%63%6f%6c%6f%72%3a%23%66%66%66%66%66%66%3b" ascii  
    $s18 = "function getDomainFromEmail($email)" fullword ascii
    $s19 = "// Get the data after the @ sign" fullword ascii
    $s20 = "<?php echo $_GET['email']; ?>" fullword ascii

  condition:
    (uint16(0) == 0x3f3c and
      filesize < 30KB and
      (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

3e46a518-87cd-4540-9741-44cc8fb2907b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion