Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22

Detects a suspicious pattern in RTF files which downloads external resources

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Christian Burkard
Date
2022-06-01
Modified
2026-05-15
Score / Quality
75 / 85

What this rule detects

Detects a suspicious pattern in RTF files which downloads external resources

It defines 11 patterns (11 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-doc-rtf-ole2link-jun22.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Doc_RTF_Ole2Link_Jun22 : FILE
{
	meta:
		description = "Detects a suspicious pattern in RTF files which downloads external resources"
		author = "Christian Burkard"
		id = "e9c83d58-6214-51d5-882a-4bd2ed6acc9a"
		date = "2022-06-01"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_doc_follina.yar#L101-L132"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68"
		logic_hash = "36cb711399197c694ac4fa4fd49cd5d587a830e152a138c81851b8e16301803d"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$sa = "\\objdata" ascii nocase
		$sb1 = "4f4c45324c696e6b" ascii
		$sb2 = "4F4C45324C696E6B" ascii
		$sc1 = "d0cf11e0a1b11ae1" ascii
		$sc2 = "D0CF11E0A1B11AE1" ascii
		$x1 = "68007400740070003a002f002f00" ascii
		$x2 = "68007400740070003A002F002F00" ascii
		$x3 = "680074007400700073003a002f002f00" ascii
		$x4 = "680074007400700073003A002F002F00" ascii
		$x5 = "6600740070003a002f002f00" ascii
		$x6 = "6600740070003A002F002F00" ascii

	condition:
		( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and $sa and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )
}

Strings (11 patterns)

IdentifierTypeValueModifiers
$satext"\\objdata"ascii nocase
$sb1text"4f4c45324c696e6b"ascii
$sb2text"4F4C45324C696E6B"ascii
$sc1text"d0cf11e0a1b11ae1"ascii
$sc2text"D0CF11E0A1B11AE1"ascii
$x1text"68007400740070003a002f002f00"ascii
$x2text"68007400740070003A002F002F00"ascii
$x3text"680074007400700073003a002f002f00"ascii
$x4text"680074007400700073003A002F002F00"ascii
$x5text"6600740070003a002f002f00"ascii
$x6text"6600740070003A002F002F00"ascii

Condition

( uint32be( 0 ) == 0x7B5C7274 or uint32be( 0 ) == 0x7B5C2A5C ) and $sa and 1 of ( $sb* ) and 1 of ( $sc* ) and 1 of ( $x* )

In plain words (Heuristic)

  • The file must start with “{\rt” — an RTF document.
  • At least 1 patterns in ( $sb* ) must match.
  • At least 1 patterns in ( $sc* ) must match.
  • At least 1 patterns in ( $x* ) must match.
  • Pattern $sa must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 4abc20e5130b59639e20bd6b8ad759af18eb284f46e99a5cc6b4f16f09456a68

Licence & attribution

Author: Christian Burkard

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e9c83d58-6214-51d5-882a-4bd2ed6acc9a

Tags:FILE

Related rules