O'Reilly logo

Learning Malware Analysis by Monnappa K A

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

7.4.4 Applications of YARA

Let's take another example of the sample that was previously used in Section 6.5Examining PE resources. The sample (5340.exe) stored a decoy excel document in its resource section; some malware programs store a decoy document to present it to the user upon execution. The following YARA rule detects an executable file containing an embedded Microsoft Office document in it. The rule will trigger if the hex string is found at an offset greater than 1024 bytes in the file (this skips the PE header), and the filesize specifies the end of the file:

rule embedded_office_document{meta:description = "Detects embedded office document"strings:    $mz = { 4D 5A }    $a = { D0 CF 11 E0 A1 B1 1A E1 }condition: ($mz at 0) and $a in ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required