Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1

Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth
Date
2023-05-29
Modified
2023-12-05
Score / Quality
65 / 85

What this rule detects

Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD

Targets: Windows PE.

It defines 7 patterns (4 text, 3 hex, 0 regex). YARA modules used: pe.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

susp-hxd-icon-anomaly-may23-1.yarDetection Rule License 1.1
import "pe"

rule SIGNATURE_BASE_SUSP_Hxd_Icon_Anomaly_May23_1 : FILE
{
	meta:
		description = "Detects suspicious use of the the free hex editor HxD's icon in PE files that don't seem to be a legitimate version of HxD"
		author = "Florian Roth"
		id = "3ac8cc92-6d76-5787-ada0-cfb6eabb4b20"
		date = "2023-05-29"
		modified = "2023-12-05"
		reference = "https://www.linkedin.com/feed/update/urn:li:activity:7068631930040188929/?utm_source=share&utm_medium=member_ios"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_file_anomalies.yar#L32-L84"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "a328687ac8b868fb78a49188b286a8951c6043a7ff6ff0c7a23c3f9b3ef15eb2"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$ac1 = { 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80
               99 00 77 0D DD 09 99 80 99 00 77 0D D0 99 98 09
               99 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 09
               99 99 00 0D D0 99 98 0F F9 99 00 0D D0 99 98 09
               9F 99 00 0D D0 99 98 09 FF 99 00 0D D0 99 98 09
               FF 99 00 0D D0 99 98 09 99 99 00 0D D0 99 98 0F
               F9 99 00 0D D0 99 98 09 99 99 00 0D 09 99 80 9F
               F9 99 99 00 09 99 80 99 F9 99 99 00 09 99 80 FF }
		$ac2 = { FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE
               FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1
               39 A2 F1 39 A2 F1 68 B8 F4 B9 DE FA FF FF FF FF
               FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF }
		$s1 = { 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A }
		$s2 = "mh-nexus.de" ascii wide
		$upx1 = "UPX0" ascii fullword
		$xs1 = "terminator" ascii wide fullword
		$xs2 = "Terminator" ascii wide fullword

	condition:
		uint16( 0 ) == 0x5a4d and 1 of ( $ac* ) and ( not 1 of ( $s* ) or filesize > 6930000 or ( pe.is_32bit ( ) and filesize < 1540000 and not $upx1 ) or ( pe.is_32bit ( ) and filesize < 590000 and $upx1 ) or ( pe.is_64bit ( ) and filesize < 6670000 and not $upx1 ) or ( pe.is_64bit ( ) and filesize < 1300000 and $upx1 ) or 1 of ( $xs* ) )
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$ac1hex{ 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80 99 00 77 0D DD 09 99 80 99 00 77 …
$ac2hex{ FF FF FF FF FF FF FF FF FF FF FF FF FF FF B9 DE FA 68 B8 F4 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1 39 A2 F1 68 B8 F4 B9 DE …
$s1hex{ 00 4D 00 61 00 EB 00 6C 00 20 00 48 00 F6 00 72 00 7A }
$s2text"mh-nexus.de"ascii wide
$upx1text"UPX0"ascii fullword
$xs1text"terminator"ascii wide fullword
$xs2text"Terminator"ascii wide fullword

Condition

uint16( 0 ) == 0x5a4d and 1 of ( $ac* ) and ( not 1 of ( $s* ) or filesize > 6930000 or ( pe.is_32bit ( ) and filesize < 1540000 and not $upx1 ) or ( pe.is_32bit ( ) and filesize < 590000 and $upx1 ) or ( pe.is_64bit ( ) and filesize < 6670000 and not $upx1 ) or ( pe.is_64bit ( ) and filesize < 1300000 and $upx1 ) or 1 of ( $xs* ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • The file must be smaller than 1540000 (a cheap guard that skips large files).
  • The file must be smaller than 590000 (a cheap guard that skips large files).
  • The file must be smaller than 6670000 (a cheap guard that skips large files).
  • The file must be smaller than 1300000 (a cheap guard that skips large files).
  • The file must be larger than 6930000.
  • At least 1 patterns in ( $ac* ) must match.
  • At least 1 patterns in ( $s* ) must match.
  • At least 1 patterns in ( $xs* ) must match.
  • Pattern $upx1 must NOT be present.
  • Uses the pe module.
  • Pattern $upx1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Florian Roth

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 3ac8cc92-6d76-5787-ada0-cfb6eabb4b20

Tags:FILE

Related rules