MALPEDIA_Win_Flawedgrace_Auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule MALPEDIA_Win_Flawedgrace_Auto: FILE {
  meta:
    description        = "autogenerated rule brought to you by yara-signator"
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    id                 = "62521b13-13e2-5f89-b92f-7685ad3e5d40"
    date               = "2023-12-06"
    modified           = "2023-12-08"
    reference          = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
    source_url         = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.flawedgrace_auto.yar#L1-L132"
    license_url        = "N/A"
    logic_hash         = "3a2e50b467b7ecb293ee257669feacddf7970c96ed36da3edcb02bab7c5dbcd0"
    score              = 75
    quality            = 75
    tags               = "FILE"
    version            = "1"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_rule_date = "20231130"
    malpedia_hash      = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
    malpedia_version   = "20230808"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"

  strings:
    $sequence_0 = { 89 41 10 8b 45 0c 89 41 1c 8a 03 88 41 24 8b 45 f4 c7 41 18 00 00 00 00 }
    $sequence_1 = { c1 e8 10 0f b6 c0 33 0c 85 e0 bb 45 00 0f b6 c2 c1 ea 08 33 0c 85 e0 b3 45 00 33 4f b8 }
    $sequence_2 = { ff 15 ?? ?? ?? ?? 8b f8 85 ff 0f 84 93 00 00 00 8b ce e8 ?? ?? ?? ?? 8d 57 04 }
    $sequence_3 = { 50 8b 85 c0 fe ff ff ff 70 04 50 e8 ?? ?? ?? ?? 8b 55 e8 }
    $sequence_4 = { c6 85 64 dc ff ff da c6 85 65 dc ff ff 02 c6 85 66 dc ff ff 48 c6 85 67 dc ff ff 65 c6 85 68 dc ff ff 61 c6 85 69 dc ff ff 70 c6 85 6a dc ff ff 52 }
    $sequence_5 = { c6 85 7f cf ff ff 48 c6 85 80 cf ff ff 83 c6 85 81 cf ff ff ec c6 85 82 cf ff ff 20 c6 85 83 cf ff ff 4c c6 85 84 cf ff ff 8b c6 85 85 cf ff ff c8 }
    $sequence_6 = { 33 55 f0 33 da 89 55 e8 33 0c 85 e0 d3 45 00 8b c2 89 8e b0 00 00 00 8b ca }
    $sequence_7 = { c6 85 2e e8 ff ff 65 c6 85 2f e8 ff ff 6c c6 85 30 e8 ff ff 6f c6 85 31 e8 ff ff 63 c6 85 32 e8 ff ff 00 c6 85 33 e8 ff ff 00 c6 85 34 e8 ff ff 50 }
    $sequence_8 = { 89 75 fc e8 ?? ?? ?? ?? 50 83 c0 10 50 51 }
    $sequence_9 = { c6 85 16 e5 ff ff 00 c6 85 17 e5 ff ff 00 c6 85 18 e5 ff ff 00 c6 85 19 e5 ff ff 00 c6 85 1a e5 ff ff 00 c6 85 1b e5 ff ff 00 c6 85 1c e5 ff ff 00 }

  condition:
    7 of them and filesize < 966656
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d8735e44-e10d-4f32-ad6b-b3f933006d88

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion