Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Maldoc_Excelmacro

Detects malicious Excel macro Artifacts

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
James Quinn
Date
2020-11-03
Modified
2023-12-05
Score / Quality
65 / 85

What this rule detects

Detects malicious Excel macro Artifacts

It defines 5 patterns (4 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-maldoc-excelmacro.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Maldoc_Excelmacro : FILE
{
	meta:
		description = "Detects malicious Excel macro Artifacts"
		author = "James Quinn"
		id = "76806717-a9a8-520e-b6b6-7718eb088de5"
		date = "2020-11-03"
		modified = "2023-12-05"
		reference = "YARA Exchange - Undisclosed Macro Builder"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_macro_builders.yar#L2-L19"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "c5d0655eaf2ca36c828675f9673a1d4284ef8719fd9ec1d354ee3284d1fb0a0c"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$artifact1 = {5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
		$url1 = "http://" wide
		$url2 = "https://" wide
		$import1 = "URLDownloadToFileA" wide ascii
		$macro = "xl/macrosheets/"

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 2000KB and $artifact1 and $macro and $import1 and 1 of ( $url* )
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$artifact1hex{5c 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 ?? 00 2e 00 ?? 00 ?? 00}
$url1text"http://"wide
$url2text"https://"wide
$import1text"URLDownloadToFileA"wide ascii
$macrotext"xl/macrosheets/"

Condition

uint16( 0 ) == 0x4b50 and filesize < 2000KB and $artifact1 and $macro and $import1 and 1 of ( $url* )

In plain words (Heuristic)

  • The file must start with “PK” — a ZIP archive (also Office Open XML, JAR, APK).
  • The file must be smaller than 2000KB (a cheap guard that skips large files).
  • At least 1 patterns in ( $url* ) must match.
  • Pattern $artifact1 must be present.
  • Pattern $macro must be present.
  • Pattern $import1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Licence & attribution

Author: James Quinn

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 76806717-a9a8-520e-b6b6-7718eb088de5

Tags:FILE

Related rules