SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26

rule SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26
{
	meta:
		description = "Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offers or descriptions to lure victims into installing malware."
		author = "Jonathan Peters (Nextron Systems)"
		id = "aae8ed59-caf0-56ae-9c38-9caca96a31e0"
		date = "2026-05-25"
		modified = "2026-06-01"
		reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L71-L83"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b"
		logic_hash = "4479c844cae60f0cabdb8b57e6de9961d4b9d5e9afdc43793fd936e0bed6899a"
		score = 70
		quality = 85
		tags = ""

	strings:
		$op = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 65 72 72 79 29 20 2F 43 72 65 61 74 6F 72 28 FE FF 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 AE 00 20 00 57 00 6F 00 72 00 64 00 20 00 4C 00 54 00 53 00 43 29 }

	condition:
		1 of them
}