SEKOIA_Apt_Apt29_Wineloader_Malicious_Pdf

rule SEKOIA_Apt_Apt29_Wineloader_Malicious_Pdf : FILE
{
	meta:
		description = "Detects malicious PDF used by APT29 to drop Wineloader"
		author = "Sekoia.io"
		id = "b1db731e-471e-493a-b76c-38d2808ccac9"
		date = "2024-03-25"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_apt29_wineloader_malicious_pdf.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "9712217ff3597468b48cdf45da588005de3a725ba554789bb7e5ae1b0f7c02a7"
		hash = "3739b2eae11c8367b576869b68d502b97676fb68d18cc0045f661fbe354afcb9"
		logic_hash = "784f5ab2602e2185e8253b5b8d9a084ede0604457b0a0674fceffbcb226e3ba1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "<</Type/Annot/Subtype/Link/Border[0 0 0]/Rect["
		$s2 = "/A<</Type/Action/S/URI/URI("
		$s3 = { 2f [2-10] 2e 70 68 70 29 3e 3e }
		$s4 = "JamrulNormal"

	condition:
		uint32be( 0 ) == 0x25504446 and $s2 in ( @s1 .. @s3 ) and $s4
}