YARA · Samir Bousseaden (YaraHunts)
SBOUSSEADEN_Hunt_Susp_Vhd
Virtual hard disk file with embedded PE
- Author
- SBousseaden
- Date
- 2020-07-13
- Score / Quality
- 65 / 73
What this rule detects
Virtual hard disk file with embedded PE
It defines 4 patterns (2 text, 2 hex, 0 regex).
YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Samir Bousseaden (YaraHunts), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: SBousseaden
Source repository: Samir Bousseaden (YaraHunts) @ 71b27a2a7c
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 14b082b2-c5cd-5f34-85e9-5987650eaacd
Tags:FILE
Related rules
- SBOUSSEADEN_Susp_Msoffice_Addins_WxllMetadata onlySuspicious / huntingSamir Bousseaden (YaraHunts)· SBousseaden· 2020-11-10
- SBOUSSEADEN_Mimikatz_KiwikeyMetadata onlyHack toolSamir Bousseaden (YaraHunts)· SBousseaden· 2020-08-08
- SBOUSSEADEN_Adsync_Creddump_V64Metadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XorMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_Adsync_Creddump_XwideMetadata onlyGenericSamir Bousseaden (YaraHunts)· SBousseaden· 2020-03-08
- SBOUSSEADEN_APT_Solarwind_Backdoor_Encoded_StringsMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-12-14
- SBOUSSEADEN_APT_Xdsspy_XduploadMetadata onlyAPT / threat actorSamir Bousseaden (YaraHunts)· SBousseaden· 2020-05-10
- SBOUSSEADEN_Cve_2019_1458Metadata onlyExploitSamir Bousseaden (YaraHunts)· SBousseaden· 2020-10-22