SEKOIA_Emmenhtal_Strings_Hta_Exe

rule SEKOIA_Emmenhtal_Strings_Hta_Exe : FILE
{
	meta:
		description = "Emmenhtal Loader string"
		author = "Sekoia.io"
		id = "64e08610-e8a4-4edd-8f6b-d4e8d2b47d87"
		date = "2024-09-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/emmenhtal_strings_hta_exe.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "e86a22f1c73b85678e64341427c7193ba65903f3c0f29af2e65d7c56d833d912"
		logic_hash = "93f85a4ccb58c6aeb664c4c843ff80a4ab7b4308a944537f7ebe087515a61659"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$char = / = String\.fromCharCode\([a-zA-Z]{2,4},[a-zA-Z]{2,4},/
		$var = "var "
		$eval = "eval("
		$script1 = "<script>"
		$script2 = "</script>MZ"

	condition:
		uint16be( 0 ) == 0x4d5a and all of them and $var in ( @script1 .. @script1 + 2000 ) and $char in ( @var .. @var + 100 )
}