YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1

Detects suspicious NullSoft Installer combination with common Copyright strings

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-10-06
Modified: 2023-12-05
Score / Quality: 65 / 85

What this rule detects

Detects suspicious NullSoft Installer combination with common Copyright strings

Targets: Windows PE.

It defines 12 patterns (12 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

susp-nullsoftinst-combo-oct20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_SUSP_Nullsoftinst_Combo_Oct20_1 : FILE
{
	meta:
		description = "Detects suspicious NullSoft Installer combination with common Copyright strings"
		author = "Florian Roth (Nextron Systems)"
		id = "380f30a6-df6b-50c6-bb2d-b8785564bbac"
		date = "2020-10-06"
		modified = "2023-12-05"
		reference = "https://twitter.com/malwrhunterteam/status/1313023627177193472"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_anomalies_keyword_combos.yar#L2-L33"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f"
		hash = "93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf"
		hash = "a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78"
		logic_hash = "8aef24295281da5ffa1c6f865eaa6cc8d60ea1df670058220bdb97651b6114cd"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$a1 = "NullsoftInst" ascii
		$b1 = "Microsoft Corporation" wide fullword
		$b2 = "Apache Software Foundation" ascii wide fullword
		$b3 = "Simon Tatham" wide fullword
		$fp1 = "nsisinstall" fullword ascii
		$fp2 = "\\REGISTRY\\MACHINE\\Software\\" wide
		$fp3 = "Apache Tomcat" wide fullword
		$fp4 = "Bot Framework Emulator" wide fullword
		$fp5 = "Firefox Helper" wide fullword
		$fp6 = "Paint.NET Setup" wide fullword
		$fp7 = "Microsoft .NET Services Installation Utility" wide fullword
		$fp8 = "License: MPL 2" wide

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2000KB and $a1 and 1 of ( $b* ) and not 1 of ( $fp* )
}

Strings (12 patterns)

Identifier	Type	Value	Modifiers
$a1	text	"NullsoftInst"	ascii
$b1	text	"Microsoft Corporation"	wide fullword
$b2	text	"Apache Software Foundation"	ascii wide fullword
$b3	text	"Simon Tatham"	wide fullword
$fp1	text	"nsisinstall"	fullword ascii
$fp2	text	"\\REGISTRY\\MACHINE\\Software\\"	wide
$fp3	text	"Apache Tomcat"	wide fullword
$fp4	text	"Bot Framework Emulator"	wide fullword
$fp5	text	"Firefox Helper"	wide fullword
$fp6	text	"Paint.NET Setup"	wide fullword
$fp7	text	"Microsoft .NET Services Installation Utility"	wide fullword
$fp8	text	"License: MPL 2"	wide

Condition

uint16( 0 ) == 0x5a4d and filesize < 2000KB and $a1 and 1 of ( $b* ) and not 1 of ( $fp* )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 2000KB (a cheap guard that skips large files).
At least 1 patterns in ( $b* ) must match.
At least 1 patterns in ( $fp* ) must match.
Pattern $a1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://twitter.com/malwrhunterteam/status/1313023627177193472

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

686b5240e5e503528cc5ac8d764883413a260716dd290f114a60af873ee6a65f
93951379e57e4f159bb62fd7dd563d1ac2f3f23c80ba89f2da2e395b8a647dcf
a9ca1d6a981ccc8d8b144f337c259891a67eb6b85ee41b03699baacf4aae9a78

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 380f30a6-df6b-50c6-bb2d-b8785564bbac

Tags:FILE

SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-09-17
SIGNATURE_BASE_SUSP_Reversed_Base64_Encoded_EXE
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-04-06
SIGNATURE_BASE_SUSP_OBFUSC_Powershell_True_Jun20_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-06-27
SIGNATURE_BASE_SUSP_PS1_JAB_Pattern_Jun22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-06-10
SIGNATURE_BASE_SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10
SIGNATURE_BASE_SUSP_Encoded_Discord_Attachment_Oct21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-10-12
SIGNATURE_BASE_SUSP_IIS_Config_Proxyshell_Artifacts
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-08-25
SIGNATURE_BASE_SUSP_Jdniexploit_Error_Indicators_Dec21_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-12-10