YARA · Signature Base (Florian Roth / Nextron)
SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1
Detects MalDocs used by FIN7 group
APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
- Author
- Florian Roth (Nextron Systems)
- Date
- 2021-09-07
- Modified
- 2023-12-05
- Score / Quality
- 85 / 85
What this rule detects
Detects MalDocs used by FIN7 group
It defines 5 patterns (4 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
apt-fin7-msdoc-sep21-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_APT_FIN7_Msdoc_Sep21_1 : FILE
{
meta:
= "Detects MalDocs used by FIN7 group"
= "Florian Roth (Nextron Systems)"
= "4fbde087-ec1e-5614-af1e-f342b1766fa2"
= "2021-09-07"
= "2023-12-05"
= "https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_fin7.yar#L277-L301"
= "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
= "d60b6a8310373c9b84e6760c24185535"
= "ffc91cdad91b8ab24840c6ef1a6c39aad081d986c21a88b3f2ea3ec1bcd3b52b"
= 85
= 85
= "FILE"
strings:
$xc1 = { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30
00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 }
$s1 = "word_data.bin" ascii fullword
$s2 = "V:\\DOC\\For_JS" ascii
$s3 = "HomeCompany" ascii
$s4 = "W10ProOff16" ascii
condition:
uint16( 0 ) == 0xcfd0 and ( 1 of ( $x* ) or 3 of them )
}
Strings (5 patterns)
| Identifier | Type | Value | Modifiers |
|---|---|---|---|
| $xc1 | hex | { 00 4A 00 6F 00 68 00 6E 00 0B 00 57 00 31 00 30 00 50 00 72 00 6F 00 4F 00 66 00 66 00 31 00 36 } | |
| $s1 | text | "word_data.bin" | ascii fullword |
| $s2 | text | "V:\\DOC\\For_JS" | ascii |
| $s3 | text | "HomeCompany" | ascii |
| $s4 | text | "W10ProOff16" | ascii |
Condition
uint16( 0 ) == 0xcfd0 and ( 1 of ( $x* ) or 3 of them )In plain words (Heuristic)
- At least 1 patterns in ( $x* ) must match.
- At least 3 patterns in the rule must match.
Test this rule in your browser
Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.
Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- d60b6a8310373c9b84e6760c24185535
Licence & attribution
Author: Florian Roth (Nextron Systems)
Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a
Licence: Detection Rule License 1.1 (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 4fbde087-ec1e-5614-af1e-f342b1766fa2
Tags:FILE
Related rules
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-10-25
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
- APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-24