Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26

Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offers or descriptions to lure victims into installing malware.

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters (Nextron Systems)
Date
2026-05-25
Modified
2026-06-01
Score / Quality
70 / 85

What this rule detects

Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offers or descriptions to lure victims into installing malware.

It defines 1 patterns (0 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-nimbus-manticore-pdf-indicators-may26.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_Nimbus_Manticore_PDF_Indicators_May26
{
	meta:
		description = "Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offers or descriptions to lure victims into installing malware."
		author = "Jonathan Peters (Nextron Systems)"
		id = "aae8ed59-caf0-56ae-9c38-9caca96a31e0"
		date = "2026-05-25"
		modified = "2026-06-01"
		reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt35_malware_may26.yar#L71-L83"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b"
		logic_hash = "4479c844cae60f0cabdb8b57e6de9961d4b9d5e9afdc43793fd936e0bed6899a"
		score = 70
		quality = 85
		tags = ""

	strings:
		$op = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 65 72 72 79 29 20 2F 43 72 65 61 74 6F 72 28 FE FF 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 AE 00 20 00 57 00 6F 00 72 00 64 00 20 00 4C 00 54 00 53 00 43 29 }

	condition:
		1 of them
}

Strings (1 patterns)

IdentifierTypeValueModifiers
$ophex{ 3C 3C 2F 41 75 74 68 6F 72 28 4A 65 72 72 79 29 20 2F 43 72 65 61 74 6F 72 28 FE FF 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 AE 00 20 00 57 00 …

Condition

1 of them

In plain words (Heuristic)

  • At least 1 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b

Licence & attribution

Author: Jonathan Peters (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: aae8ed59-caf0-56ae-9c38-9caca96a31e0

Related rules