Zum Inhalt springen
yararules.org
Menü

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22

Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments

Verdächtig / HuntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Kompiliert mit YARA-X
Autor
Christian Burkard
Datum
2022-06-01
Geändert
2026-05-15
Score / Qualität
75 / 83

Was diese Regel erkennt

Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments

Sie definiert 33 Muster (33 Text, 0 Hex, 0 Regex).

Zusammenfassung aus den Metadaten und der Bedingung der Regel erzeugt.

Regelquelltext

.yar herunterladen
susp-doc-rtf-ole2link-email-jun22.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
		author = "Christian Burkard"
		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
		date = "2022-06-01"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L134-L193"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
		score = 75
		quality = 83
		tags = "FILE"

	strings:
		$sa1 = "XG9iamRhdG" ascii
		$sa2 = "xvYmpkYXRh" ascii
		$sa3 = "cb2JqZGF0Y" ascii
		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii

	condition:
		filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

Strings (33 Muster)

BezeichnerTypWertModifikatoren
$sa1Text"XG9iamRhdG"ascii
$sa2Text"xvYmpkYXRh"ascii
$sa3Text"cb2JqZGF0Y"ascii
$sb1Text"NGY0YzQ1MzI0YzY5NmU2Y"ascii
$sb2Text"RmNGM0NTMyNGM2OTZlNm"ascii
$sb3Text"0ZjRjNDUzMjRjNjk2ZTZi"ascii
$sb4Text"NEY0QzQ1MzI0QzY5NkU2Q"ascii
$sb5Text"RGNEM0NTMyNEM2OTZFNk"ascii
$sb6Text"0RjRDNDUzMjRDNjk2RTZC"ascii
$sc1Text"ZDBjZjExZTBhMWIxMWFlM"ascii
$sc2Text"QwY2YxMWUwYTFiMTFhZT"ascii
$sc3Text"kMGNmMTFlMGExYjExYWUx"ascii
$sc4Text"RDBDRjExRTBBMUIxMUFFM"ascii
$sc5Text"QwQ0YxMUUwQTFCMTFBRT"ascii
$sc6Text"EMENGMTFFMEExQjExQUUx"ascii
$x1Text"NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM"ascii
$x2Text"Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD"ascii
$x3Text"2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw"ascii
$x4Text"NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM"ascii
$x5Text"Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD"ascii
$x6Text"2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw"ascii
$x7Text"NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD"ascii
$x8Text"Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw"ascii
$x9Text"2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM"ascii
$x10Text"NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD"ascii
$x11Text"Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw"ascii
$x12Text"2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM"ascii
$x13Text"NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw"ascii
$x14Text"Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM"ascii
$x15Text"2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD"ascii
$x16Text"NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw"ascii
$x17Text"Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM"ascii
$x18Text"2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD"ascii

Bedingung

filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )

In Worten (Heuristik)

  • Die Datei muss kleiner als 10MB sein (eine günstige Grenze, die große Dateien ausschließt).
  • Mindestens 1 Muster aus ( $sa* ) müssen treffen.
  • Mindestens 1 Muster aus ( $sb* ) müssen treffen.
  • Mindestens 1 Muster aus ( $sc* ) müssen treffen.
  • Mindestens 1 Muster aus ( $x* ) müssen treffen.

Diese Regel im Browser testen

Legen Sie eine Datei ab, um sie mit dieser Regel und YARA-X als WebAssembly zu scannen. Nichts wird hochgeladen.

Datei hier ablegen oder klicken zum AuswählenLokal mit YARA-X gescannt. Dateien bis 200 MB.

Im Editor öffnen

Proben-Hashes

Hashes der Proben, die der Autor in den Metadaten der Regel nennt (in Ihrer Threat-Intelligence-Plattform nachschlagen).

  • 4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68

Lizenz & Namensnennung

Autor: Christian Burkard

Quell-Repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Lizenz: Detection Rule License 1.1 (Repository-Lizenz)

Originalregel

Gespiegelt über YARA Forge 20260927, das Regelnamen mit der Quelle präfixiert und normalisierte Meta-Felder ergänzt.

Regel-ID: 48cde505-3ce4-52ef-b338-0c08ac4f63de

Tags:FILE

Verwandte Regeln