YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_HKTL_Nim_Nimpackt

Detects binaries generated with NimPackt v1

Hack toolSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)

Author: Cas van Cooten
Date: 2022-01-26
Modified: 2023-12-05
Score / Quality: 80 / 79

What this rule detects

Detects binaries generated with NimPackt v1

Targets: Windows PE.

It defines 6 patterns (2 text, 4 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

hktl-nim-nimpackt.yarDetection Rule License 1.1

rule SIGNATURE_BASE_HKTL_Nim_Nimpackt : EXE FILE HKTL
{
	meta:
		description = "Detects binaries generated with NimPackt v1"
		author = "Cas van Cooten"
		id = "3399d937-133f-5701-840e-eaf68b2f1ec9"
		date = "2022-01-26"
		modified = "2023-12-05"
		reference = "https://github.com/chvancooten/NimPackt-v1"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_nimpackt.yar#L2-L23"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "2bda7acb440d1c72efeaddcb18b736343d658d59feccf6c9339b313cd35f32eb"
		score = 80
		quality = 79
		tags = "EXE, FILE, HKTL"

	strings:
		$nim1 = "fatal.nim" ascii fullword
		$nim2 = "winim" ascii
		$np1 = { 4E 69 6D 50 61 63 6B 74 }
		$sus1 = { 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
		$sus2 = { 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
		$sus3 = { 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }

	condition:
		uint16( 0 ) == 0x5A4D and filesize < 750KB and 1 of ( $nim* ) and ( $np1 or 2 of ( $sus* ) )
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$nim1	text	"fatal.nim"	ascii fullword
$nim2	text	"winim"	ascii
$np1	hex	{ 4E 69 6D 50 61 63 6B 74 }
$sus1	hex	{ 61 6D 73 69 00 00 00 00 B8 57 00 07 80 C3 }
$sus2	hex	{ 5B 2B 5D 20 49 6E 6A 65 63 74 65 64 }
$sus3	hex	{ 5C 2D 2D 20 62 79 74 65 73 20 77 72 69 74 74 65 6E 3A }

Condition

uint16( 0 ) == 0x5A4D and filesize < 750KB and 1 of ( $nim* ) and ( $np1 or 2 of ( $sus* ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 750KB (a cheap guard that skips large files).
At least 1 patterns in ( $nim* ) must match.
At least 2 patterns in ( $sus* ) must match.
Pattern $np1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/chvancooten/NimPackt-v1

Licence & attribution

Author: Cas van Cooten

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3399d937-133f-5701-840e-eaf68b2f1ec9

Tags:EXE FILE HKTL