Skip to content
yararules.org
Menu

YARA · ditekSHen detection

DITEKSHEN_INDICATOR_OLE_Suspicious_Activex

detects OLE documents with suspicious ActiveX content

Suspicious / huntingditekSHen detectionBSD 2-Clause LicenseCompiles with YARA-X (with warnings)
Author
ditekSHen
Date
2020-11-06
Modified
2024-09-06
Score / Quality
65 / 73

What this rule detects

detects OLE documents with suspicious ActiveX content

It defines 20 patterns (17 text, 3 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
indicator-ole-suspicious-activex.yarBSD 2-Clause License
rule DITEKSHEN_INDICATOR_OLE_Suspicious_Activex : FILE
{
	meta:
		description = "detects OLE documents with suspicious ActiveX content"
		author = "ditekSHen"
		id = "e4a74955-8519-561d-bb23-6469e7ae5aaa"
		date = "2020-11-06"
		modified = "2024-09-06"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/indicator_office.yar#L646-L676"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d9a672b0eeccd93b4ae98fef45560490171f8fc16b712d1e0141fc0ef1d0e342"
		score = 65
		quality = 73
		tags = "FILE"

	strings:
		$vb = "\\VBE7.DLL" ascii
		$ax1 = "_Layout" ascii
		$ax2 = "MultiPage1_" ascii
		$ax3 = "_MouseMove" ascii
		$ax4 = "_MouseHover" ascii
		$ax5 = "_MouseLeave" ascii
		$ax6 = "_MouseEnter" ascii
		$ax7 = "ImageCombo21_Change" ascii
		$ax8 = "InkEdit1_GotFocus" ascii
		$ax9 = "InkPicture1_" ascii
		$ax10 = "SystemMonitor1_" ascii
		$ax11 = "WebBrowser1_" ascii
		$ax12 = "_Click" ascii
		$kw1 = "CreateObject" ascii
		$kw2 = "CreateTextFile" ascii
		$kw3 = ".SpawnInstance_" ascii
		$kw4 = "WScript.Shell" ascii
		$kw5 = { 43 68 72 [0-2] 41 73 63 [0-2] 4d 69 64 }
		$kw6 = { 43 68 [0-2] 72 24 28 40 24 28 22 26 48 }
		$kw7 = { 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }

	condition:
		uint16( 0 ) == 0xcfd0 and $vb and 1 of ( $ax* ) and 2 of ( $kw* )
}

Strings (20 patterns)

IdentifierTypeValueModifiers
$vbtext"\\VBE7.DLL"ascii
$ax1text"_Layout"ascii
$ax2text"MultiPage1_"ascii
$ax3text"_MouseMove"ascii
$ax4text"_MouseHover"ascii
$ax5text"_MouseLeave"ascii
$ax6text"_MouseEnter"ascii
$ax7text"ImageCombo21_Change"ascii
$ax8text"InkEdit1_GotFocus"ascii
$ax9text"InkPicture1_"ascii
$ax10text"SystemMonitor1_"ascii
$ax11text"WebBrowser1_"ascii
$ax12text"_Click"ascii
$kw1text"CreateObject"ascii
$kw2text"CreateTextFile"ascii
$kw3text".SpawnInstance_"ascii
$kw4text"WScript.Shell"ascii
$kw5hex{ 43 68 72 [0-2] 41 73 63 [0-2] 4d 69 64 }
$kw6hex{ 43 68 [0-2] 72 24 28 40 24 28 22 26 48 }
$kw7hex{ 41 63 74 69 76 65 44 6f 63 75 6d 65 6e 74 }

Condition

uint16( 0 ) == 0xcfd0 and $vb and 1 of ( $ax* ) and 2 of ( $kw* )

In plain words (Heuristic)

  • At least 1 patterns in ( $ax* ) must match.
  • At least 2 patterns in ( $kw* ) must match.
  • Pattern $vb must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: ditekSHen

Source repository: ditekSHen detection @ e76c93dcde

Licence: BSD 2-Clause License (repository licence)

Copyright notice: Copyright 2021 by ditekSHen (https://github.com/ditekshen/detection).

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e4a74955-8519-561d-bb23-6469e7ae5aaa

Tags:FILE

Related rules