Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1

Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks

Suspicious / huntingSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X (with warnings)
Author
Florian Roth (Nextron Systems)
Date
2022-06-23
Modified
2023-12-05
Score / Quality
65 / 85

What this rule detects

Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks

It defines 6 patterns (3 text, 3 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-zip-iso-phishattachment-pattern-jun22-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_ZIP_ISO_Phishattachment_Pattern_Jun22_1 : FILE
{
	meta:
		description = "Detects suspicious small base64 encoded ZIP files (MIME email attachments) with .iso files as content as often used in phishing attacks"
		author = "Florian Roth (Nextron Systems)"
		id = "638541a6-d2d4-513e-978c-9d1b9f5e3b71"
		date = "2022-06-23"
		modified = "2023-12-05"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_phish_attachments.yar#L23-L41"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "21de56d6209050b429c0cce82fd334d1b38a2a3727db5ead06f36fa9d503e193"
		score = 65
		quality = 85
		tags = "FILE"

	strings:
		$pkzip_base64_1 = { 0A 55 45 73 44 42 }
		$pkzip_base64_2 = { 0A 55 45 73 44 42 }
		$pkzip_base64_3 = { 0A 55 45 73 48 43 }
		$iso_1 = "Lmlzb1BL"
		$iso_2 = "5pc29QS"
		$iso_3 = "uaXNvUE"

	condition:
		filesize < 2000KB and 1 of ( $pk* ) and 1 of ( $iso* )
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$pkzip_base64_1hex{ 0A 55 45 73 44 42 }
$pkzip_base64_2hex{ 0A 55 45 73 44 42 }
$pkzip_base64_3hex{ 0A 55 45 73 48 43 }
$iso_1text"Lmlzb1BL"
$iso_2text"5pc29QS"
$iso_3text"uaXNvUE"

Condition

filesize < 2000KB and 1 of ( $pk* ) and 1 of ( $iso* )

In plain words (Heuristic)

  • The file must be smaller than 2000KB (a cheap guard that skips large files).
  • At least 1 patterns in ( $pk* ) must match.
  • At least 1 patterns in ( $iso* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 638541a6-d2d4-513e-978c-9d1b9f5e3b71

Tags:FILE

Related rules