Skip to content
yararules.org
Menu

YARA · elceef yara-rulz

ELCEEF_Suspicious_SFX

Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe

Suspicious / huntingelceef yara-rulzMIT LicenseCompiles with YARA-X (with warnings)
Author
marcin@ulikowski.pl
Date
2023-04-04
Score / Quality
65 / 73

What this rule detects

Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe

Targets: Windows PE.

It defines 5 patterns (3 text, 2 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
suspicious-sfx.yarMIT License
rule ELCEEF_Suspicious_SFX : FILE
{
	meta:
		description = "Detects self-extracting archives (SFX) executing cmd.exe or powershell.exe"
		author = "marcin@ulikowski.pl"
		id = "78f4ae8b-ba17-5c02-a6f0-66bec873aba8"
		date = "2023-04-04"
		modified = "2023-04-04"
		reference = "https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/"
		source_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/rules/Suspicious_SFX.yara#L1-L22"
		license_url = "https://github.com/elceef/yara-rulz/blob/5683b294a12cf0c875b624933586029ae43a852f/LICENSE"
		logic_hash = "688ed356e2fa936a0e07a8479591c28fb457053ed94351bad4bf367b02f04b0a"
		score = 65
		quality = 73
		tags = "FILE"

	strings:
		$rar = { 52 61 72 21 }
		$zip = { 50 4b 03 04 }
		$setup_cmd = "\nSetup=cmd"
		$setup_powershell = "\nSetup=powershell"
		$silent = "\nSilent=1"

	condition:
		filesize < 1MB and uint16be( 0 ) == 0x4d5a and any of ( $zip , $rar ) and any of ( $setup_* ) and $silent
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$rarhex{ 52 61 72 21 }
$ziphex{ 50 4b 03 04 }
$setup_cmdtext"\nSetup=cmd"
$setup_powershelltext"\nSetup=powershell"
$silenttext"\nSilent=1"

Condition

filesize < 1MB and uint16be( 0 ) == 0x4d5a and any of ( $zip , $rar ) and any of ( $setup_* ) and $silent

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • The file must be smaller than 1MB (a cheap guard that skips large files).
  • At least one pattern in ( $zip , $rar ) must match.
  • At least one pattern in ( $setup_* ) must match.
  • Pattern $silent must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: marcin@ulikowski.pl

Source repository: elceef yara-rulz @ 5683b294a1

Licence: MIT License (repository licence)

Copyright notice: Copyright (c) 2022 Marcin Ulikowski

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 78f4ae8b-ba17-5c02-a6f0-66bec873aba8

Tags:FILE

Related rules