Let's take another example of the sample that was previously used in Section 6.5, Examining PE resources. The sample (5340.exe) stored a decoy excel document in its resource section; some malware programs store a decoy document to present it to the user upon execution. The following YARA rule detects an executable file containing an embedded Microsoft Office document in it. The rule will trigger if the hex string is found at an offset greater than 1024 bytes in the file (this skips the PE header), and the filesize specifies the end of the file:
rule embedded_office_document{meta:description = "Detects embedded office document"strings: $mz = { 4D 5A } $a = { D0 CF 11 E0 A1 B1 1A E1 }condition: ($mz at 0) and $a in ...
