Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22

Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Christian Burkard
Date
2022-06-01
Modified
2026-05-15
Score / Quality
75 / 83

What this rule detects

Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments

It defines 33 patterns (33 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-doc-rtf-ole2link-email-jun22.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_EMAIL_Jun22 : FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources inside e-mail attachments"
		author = "Christian Burkard"
		id = "48cde505-3ce4-52ef-b338-0c08ac4f63de"
		date = "2022-06-01"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L134-L193"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		logic_hash = "fcbb3e32762f8c67b5b226e8095b767d630f8c118521a82fc22f9a3cc272b794"
		score = 75
		quality = 83
		tags = "FILE"

	strings:
		$sa1 = "XG9iamRhdG" ascii
		$sa2 = "xvYmpkYXRh" ascii
		$sa3 = "cb2JqZGF0Y" ascii
		$sb1 = "NGY0YzQ1MzI0YzY5NmU2Y" ascii
		$sb2 = "RmNGM0NTMyNGM2OTZlNm" ascii
		$sb3 = "0ZjRjNDUzMjRjNjk2ZTZi" ascii
		$sb4 = "NEY0QzQ1MzI0QzY5NkU2Q" ascii
		$sb5 = "RGNEM0NTMyNEM2OTZFNk" ascii
		$sb6 = "0RjRDNDUzMjRDNjk2RTZC" ascii
		$sc1 = "ZDBjZjExZTBhMWIxMWFlM" ascii
		$sc2 = "QwY2YxMWUwYTFiMTFhZT" ascii
		$sc3 = "kMGNmMTFlMGExYjExYWUx" ascii
		$sc4 = "RDBDRjExRTBBMUIxMUFFM" ascii
		$sc5 = "QwQ0YxMUUwQTFCMTFBRT" ascii
		$sc6 = "EMENGMTFFMEExQjExQUUx" ascii
		$x1 = "NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x2 = "Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x3 = "2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x4 = "NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x5 = "Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii
		$x6 = "2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x7 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD" ascii
		$x8 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw" ascii
		$x9 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM" ascii
		$x10 = "NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD" ascii
		$x11 = "Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw" ascii
		$x12 = "2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM" ascii
		$x13 = "NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw" ascii
		$x14 = "Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM" ascii
		$x15 = "2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD" ascii
		$x16 = "NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw" ascii
		$x17 = "Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM" ascii
		$x18 = "2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD" ascii

	condition:
		filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

Strings (33 patterns)

IdentifierTypeValueModifiers
$sa1text"XG9iamRhdG"ascii
$sa2text"xvYmpkYXRh"ascii
$sa3text"cb2JqZGF0Y"ascii
$sb1text"NGY0YzQ1MzI0YzY5NmU2Y"ascii
$sb2text"RmNGM0NTMyNGM2OTZlNm"ascii
$sb3text"0ZjRjNDUzMjRjNjk2ZTZi"ascii
$sb4text"NEY0QzQ1MzI0QzY5NkU2Q"ascii
$sb5text"RGNEM0NTMyNEM2OTZFNk"ascii
$sb6text"0RjRDNDUzMjRDNjk2RTZC"ascii
$sc1text"ZDBjZjExZTBhMWIxMWFlM"ascii
$sc2text"QwY2YxMWUwYTFiMTFhZT"ascii
$sc3text"kMGNmMTFlMGExYjExYWUx"ascii
$sc4text"RDBDRjExRTBBMUIxMUFFM"ascii
$sc5text"QwQ0YxMUUwQTFCMTFBRT"ascii
$sc6text"EMENGMTFFMEExQjExQUUx"ascii
$x1text"NjgwMDc0MDA3NDAwNzAwMDNhMDAyZjAwMmYwM"ascii
$x2text"Y4MDA3NDAwNzQwMDcwMDAzYTAwMmYwMDJmMD"ascii
$x3text"2ODAwNzQwMDc0MDA3MDAwM2EwMDJmMDAyZjAw"ascii
$x4text"NjgwMDc0MDA3NDAwNzAwMDNBMDAyRjAwMkYwM"ascii
$x5text"Y4MDA3NDAwNzQwMDcwMDAzQTAwMkYwMDJGMD"ascii
$x6text"2ODAwNzQwMDc0MDA3MDAwM0EwMDJGMDAyRjAw"ascii
$x7text"NjgwMDc0MDA3NDAwNzAwMDczMDAzYTAwMmYwMDJmMD"ascii
$x8text"Y4MDA3NDAwNzQwMDcwMDA3MzAwM2EwMDJmMDAyZjAw"ascii
$x9text"2ODAwNzQwMDc0MDA3MDAwNzMwMDNhMDAyZjAwMmYwM"ascii
$x10text"NjgwMDc0MDA3NDAwNzAwMDczMDAzQTAwMkYwMDJGMD"ascii
$x11text"Y4MDA3NDAwNzQwMDcwMDA3MzAwM0EwMDJGMDAyRjAw"ascii
$x12text"2ODAwNzQwMDc0MDA3MDAwNzMwMDNBMDAyRjAwMkYwM"ascii
$x13text"NjYwMDc0MDA3MDAwM2EwMDJmMDAyZjAw"ascii
$x14text"Y2MDA3NDAwNzAwMDNhMDAyZjAwMmYwM"ascii
$x15text"2NjAwNzQwMDcwMDAzYTAwMmYwMDJmMD"ascii
$x16text"NjYwMDc0MDA3MDAwM0EwMDJGMDAyRjAw"ascii
$x17text"Y2MDA3NDAwNzAwMDNBMDAyRjAwMkYwM"ascii
$x18text"2NjAwNzQwMDcwMDAzQTAwMkYwMDJGMD"ascii

Condition

filesize < 10MB and 1 of ( $sa* ) and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )

In plain words (Heuristic)

  • The file must be smaller than 10MB (a cheap guard that skips large files).
  • At least 1 patterns in ( $sa* ) must match.
  • At least 1 patterns in ( $sb* ) must match.
  • At least 1 patterns in ( $sc* ) must match.
  • At least 1 patterns in ( $x* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68

Licence & attribution

Author: Christian Burkard

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 48cde505-3ce4-52ef-b338-0c08ac4f63de

Tags:FILE

Related rules