MALPEDIA_Win_Compfun_Auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule MALPEDIA_Win_Compfun_Auto: FILE {
  meta:
    description        = "autogenerated rule brought to you by yara-signator"
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    id                 = "b70b97d4-0cf0-525a-92ea-8899bccf1319"
    date               = "2023-12-06"
    modified           = "2023-12-08"
    reference          = "https://malpedia.caad.fkie.fraunhofer.de/details/win.compfun"
    source_url         = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.compfun_auto.yar#L1-L161"
    license_url        = "N/A"
    logic_hash         = "a0b696c7a840205849cf5ac2e95df1021718fd8d1c1053a2c6b648baa042ec58"
    score              = 75
    quality            = 75
    tags               = "FILE"
    version            = "1"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_rule_date = "20231130"
    malpedia_hash      = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
    malpedia_version   = "20230808"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"

  strings:
    $sequence_0  = { 8d 85 7c fe ff ff 50 8d 85 7c ff ff ff 50 e8 ?? ?? ?? ?? 59 50 }
    $sequence_1  = { c7 46 0c 65 72 61 74 c7 46 10 6f 72 20 63 c7 46 14 6c 61 73 73 c6 46 18 00 8b c6 5e }
    $sequence_2  = { 56 e8 ?? ?? ?? ?? 83 c4 0c c7 46 08 69 7a 65 20 c7 06 47 65 74 46 c7 46 04 69 6c 65 53 c6 46 0b 00 }
    $sequence_3  = { c7 46 04 72 65 61 74 c7 46 08 65 55 73 65 c7 46 0c 72 54 68 72 c6 46 13 00 }
    $sequence_4  = { e8 ?? ?? ?? ?? 83 c4 0c c7 46 0c 33 32 20 20 c7 06 49 6e 70 72 }
    $sequence_5  = { 68 80 00 00 00 6a 00 56 e8 ?? ?? ?? ?? 83 c4 0c c7 06 47 65 74 46 c7 46 04 75 6c 6c 50 }
    $sequence_6  = { c6 46 0f 00 8b c6 5e 5d c3 55 }
    $sequence_7  = { c7 46 08 25 20 20 20 c7 06 25 41 50 50 c7 46 04 44 41 54 41 c6 46 09 00 8b c6 5e }
    $sequence_8  = { 03 4c 24 60 48 8b 44 24 50 89 48 20 48 8b 4c 24 50 }
    $sequence_9  = { 03 c1 48 63 d0 48 8b 4c 24 30 48 8b 44 24 38 }
    $sequence_10 = { 03 c1 89 44 24 20 8b 44 24 20 83 c0 01 }
    $sequence_11 = { 03 c1 89 44 24 20 8b 4c 24 38 48 8b 44 24 50 }
    $sequence_12 = { 03 c1 89 44 24 20 8b 54 24 38 48 6b d2 18 }
    $sequence_13 = { 03 4c 24 2c 48 8b 44 24 70 89 48 20 48 8d 54 24 40 }
    $sequence_14 = { 03 c1 89 44 24 34 8b 44 24 30 39 44 24 34 }
    $sequence_15 = { 03 44 24 2c 8b c8 e8 ?? ?? ?? ?? 48 89 44 24 48 }

  condition:
    7 of them and filesize < 402432
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8de8462f-7eed-4930-b046-bcbfe0ab1626

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion