Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Turn off MALPEDIA_Win_Unidentified_107_Auto rule #298

Merged
merged 2 commits into from
Jul 1, 2024

Conversation

egibs
Copy link
Member

@egibs egibs commented Jun 29, 2024

Closes: #284

This rule could probably be tweaked, but we don't currently have a way to selectively override third-party rules.

The rule for reference:

rule MALPEDIA_Win_Unidentified_107_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "3e7e44ff-0f02-5267-8346-e5f949ff1ff2"
		date = "2023-12-06"
		modified = "2023-12-08"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107"
		source_url = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.unidentified_107_auto.yar#L1-L117"
		license_url = "N/A"
		logic_hash = "36a3784a29d5434d0fa9e9c5acdfc21d8509c8e92eeaa689801f442b7fb11fdb"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20231130"
		malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
		malpedia_version = "20230808"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4139d9 75d8 4c89e1 e8???????? }
		$sequence_1 = { 48897008 4c89e1 ff15???????? 488b05???????? 4c89e1 48891d???????? }
		$sequence_2 = { 0f83d6fdffff 4c8b35???????? 8b7304 448b2b 4883c308 4c01f6 44032e }
		$sequence_3 = { 034208 4839c1 7214 4883c228 }
		$sequence_4 = { 0f8584000000 4c8b3e 4929c7 4901cf }
		$sequence_5 = { e8???????? 4c89e1 ff15???????? 31c0 4883c428 }
		$sequence_6 = { 8b15???????? 85d2 0f8ea1feffff 488b35???????? 31db 4c8d65fc }
		$sequence_7 = { e8???????? 4989c7 48b9ca0e99c700000000 e8???????? 4883c464 488b4c2408 }
		$sequence_8 = { 4183fc01 0f85a9feffff 8b05???????? 85c0 0f8e9bfeffff 83e801 488b1d???????? }
		$sequence_9 = { 4c89442418 4c894c2420 4883ec64 48c7c10f15af3d }

	condition:
		7 of them and filesize <254976
}

Might be a case where 8 of them would be sufficient if we're matching seven by default.

@egibs egibs requested a review from tstromberg June 29, 2024 13:14
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
@egibs egibs force-pushed the turn-off-malpedia-107 branch from b654904 to c4e033b Compare June 29, 2024 13:18
@egibs egibs added the rules Adds or modifies YARA Rules label Jun 30, 2024
@tstromberg tstromberg enabled auto-merge (squash) July 1, 2024 15:06
@tstromberg tstromberg merged commit dd8edde into chainguard-dev:main Jul 1, 2024
6 checks passed
@egibs egibs deleted the turn-off-malpedia-107 branch July 19, 2024 13:20
egibs added a commit to egibs/malcontent that referenced this pull request Aug 5, 2024
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
egibs added a commit to egibs/malcontent that referenced this pull request Sep 25, 2024
Signed-off-by: egibs <20933572+egibs@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
rules Adds or modifies YARA Rules
Projects
None yet
Development

Successfully merging this pull request may close these issues.

probable false: 3P/malpedia/win/unidentified/107 with jlinenative.dll in multiple packages
2 participants