Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char

Finding hidden/very-hidden macros with many CHAR functions

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
DissectMalware
Date
2020-04-07
Modified
2023-12-05
Score / Quality
65 / 85

What this rule detects

Finding hidden/very-hidden macros with many CHAR functions

It defines 5 patterns (1 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-macro-sheet-obfuscated-char.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Macro_Sheet_Obfuscated_Char : FILE
{
	meta:
		description = "Finding hidden/very-hidden macros with many CHAR functions"
		author = "DissectMalware"
		id = "791e9bba-3e4e-5efd-a800-a612c6f92cfb"
		date = "2020-04-07"
		modified = "2023-12-05"
		reference = "https://twitter.com/DissectMalware/status/1247595433305800706"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_susp_office_dropper.yar#L122-L139"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b"
		logic_hash = "0953d1f916df570cb3d053bf4fdac196bdbd806df4b6c0a982ed9949a3676e6c"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$ole_marker = {D0 CF 11 E0 A1 B1 1A E1}
		$s1 = "Excel" fullword ascii
		$macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
		$macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
		$char_func = {06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D  00 41 6F 00}

	condition:
		$ole_marker at 0 and 1 of ( $macro_sheet_h* ) and #char_func > 10 and $s1
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$ole_markerhex{D0 CF 11 E0 A1 B1 1A E1}
$s1text"Excel"fullword ascii
$macro_sheet_h1hex{85 00 ?? ?? ?? ?? ?? ?? 01 01}
$macro_sheet_h2hex{85 00 ?? ?? ?? ?? ?? ?? 02 01}
$char_funchex{06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 1E 3D 00 41 6F 00}

Condition

$ole_marker at 0 and 1 of ( $macro_sheet_h* ) and #char_func > 10 and $s1

In plain words (Heuristic)

  • At least 1 patterns in ( $macro_sheet_h* ) must match.
  • Pattern $char_func must occur > 10 times.
  • Pattern $ole_marker must be found at offset 0.
  • Pattern $s1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 0e9ec7a974b87f4c16c842e648dd212f80349eecb4e636087770bc1748206c3b

Licence & attribution

Author: DissectMalware

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 791e9bba-3e4e-5efd-a800-a612c6f92cfb

Tags:FILE