Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1

Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Nils Kuhnert
Date
2021-06-04
Modified
2023-12-05
Score / Quality
75 / 85

What this rule detects

Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file.

It defines 1 patterns (1 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-crime-unknown-lnk-jun21-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1 : LNK POWERSHELL FILE
{
	meta:
		description = "Triggers on malicious link files which calls powershell with an obfuscated payload and downloads an HTA file."
		author = "Nils Kuhnert"
		id = "d1aac420-fd91-5577-8efd-fcdd7f733981"
		date = "2021-06-04"
		modified = "2023-12-05"
		reference = "https://github.com/Neo23x0/signature-base"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_crime_unknown.yar#L18-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942"
		hash = "f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522"
		hash = "183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45"
		hash = "a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe"
		hash = "455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2"
		logic_hash = "460e764cbd9fbfa1a2156059d0042a0bea5a939d501050a733a789d236015d37"
		score = 75
		quality = 85
		tags = "LNK, POWERSHELL, FILE"

	strings:
		$uid = "S-1-5-21-1437133880-1006698037-385855442-1004" wide

	condition:
		uint16( 0 ) == 0x004c and all of them
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$uidtext"S-1-5-21-1437133880-1006698037-385855442-1004"wide

Condition

uint16( 0 ) == 0x004c and all of them

In plain words (Heuristic)

  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 8fc7f25da954adcb8f91d5b0e1967e4a90ca132b280aa6ae73e150b55d301942
  • f5da192f4e4dfb6b728aee1821d10bec6d68fb21266ce32b688e8cae7898a522
  • 183a9b3c04d16a1822c788d7a6e78943790ee2cdeea12a38e540281091316e45
  • a38c6aa3e1c429a27226519b38f39f03b0b1b9d75fd43cd7e067c5e542967afe
  • 455f7b6b975fb8f7afc6295ec40dae5696f5063d1651f3b2477f10976a3b67b2

Licence & attribution

Author: Nils Kuhnert

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d1aac420-fd91-5577-8efd-fcdd7f733981

Tags:LNKPOWERSHELLFILE

Related rules