Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop

Detects XOR encryption (c. 2003) in Excel file formats

GenericSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
@JohnLaTwc
Date
2020-10-09
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Detects XOR encryption (c. 2003) in Excel file formats

Targets: OLE / legacy Office.

It defines 2 patterns (0 text, 2 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
gen-excel-xor-obfuscation-velvetsweatshop.yarDetection Rule License 1.1
rule SIGNATURE_BASE_Gen_Excel_Xor_Obfuscation_Velvetsweatshop : FILE
{
	meta:
		description = "Detects XOR encryption (c. 2003) in Excel file formats"
		author = "@JohnLaTwc"
		id = "8a16105c-4f43-5a35-941c-6ee9593b039c"
		date = "2020-10-09"
		modified = "2023-12-05"
		reference = "https://twitter.com/BouncyHat/status/1308896366782042113"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_excel_xor_obfuscation_velvetsweatshop.yar#L3-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0"
		hash = "14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a"
		hash = "dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23"
		hash = "4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2"
		logic_hash = "c38d56199d34adfc98d8032321239ab20c6eaa8abcafd56f8e1cf24fd3a4094f"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$olemarker = { D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
		$FilePass_XOR_Obfuscation_VelvetSweatshop = { 2F 00 06 00 00 00 59 B3 0A 9A }

	condition:
		uint32( 0 ) == 0xe011cfd0 and filesize < 400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop
}

Strings (2 patterns)

IdentifierTypeValueModifiers
$olemarkerhex{ D0 CF 11 E0 A1 B1 1A E1 00 00 00 }
$FilePass_XOR_Obfuscation_VelvetSweatshophex{ 2F 00 06 00 00 00 59 B3 0A 9A }

Condition

uint32( 0 ) == 0xe011cfd0 and filesize < 400KB and $olemarker at 0 and $FilePass_XOR_Obfuscation_VelvetSweatshop

In plain words (Heuristic)

  • The file must start with the OLE header — legacy Office documents, MSI.
  • The file must be smaller than 400KB (a cheap guard that skips large files).
  • Pattern $olemarker must be found at offset 0.
  • Pattern $FilePass_XOR_Obfuscation_VelvetSweatshop must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • da1999c23ee2dae02a169fd2208b9766cb8f046a895f5f52bed45615eea94da0
  • 14a32b8a504db3775e793be59d7bd5b584ea732c3ca060b2398137efbfd18d5a
  • dd3e89e7bde993f6f1b280f2bf933a5cc2797f4e8736aed4010aaf46e9854f23
  • 4e40253b382b20e273edf82362f1c89e916f7ab8d3c518818a76cb6127d4e7c2

Licence & attribution

Author: @JohnLaTwc

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8a16105c-4f43-5a35-941c-6ee9593b039c

Tags:FILE