112 lines
12 KiB
Text
112 lines
12 KiB
Text
|
rule CVE_2012_0158_1 {
|
||
|
|
meta:
|
||
|
|
author = "cabrel@zerklabs.com"
|
||
|
|
description = "ListView OCX Exploit"
|
||
|
|
url = "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
|
||
|
|
|
||
|
|
file_1 = "Statement ID 4657-345-347-0332.doc"
|
||
|
|
file_1_seen = "2013-05-09"
|
||
|
|
file_1_sha256 = "807a355c641eb6e1de81757c31d711df1cd01f5858814091d8655ca1e6bdd538"
|
||
|
|
|
||
|
|
file_2 = "BOA statement id 454-33-2463.doc"
|
||
|
|
file_2_seen = "2013-05-13"
|
||
|
|
file_2_sha256 = "9c9627490fcae513ca0461737c981a7bd4a2a18d50d4aef5ba66d780141f1a27"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = { 64 30 63 66 31 31 65 30 61 31 62 31 31 61 65 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 33 65 30 30 30 33 30 30 66 65 66 66 30 39 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$b = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$c = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$d = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$e = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 64 66 66 66 66 66 66 66 65 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$f = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$g = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$h = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 }
|
||
|
|
$i = { 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 35 32 30 30 36 66 30 30 36 66 30 30 37 34 30 30 32 30 30 30 34 35 30 30 36 65 30 30 37 34 30 30 37 32 30 30 37 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 36 30 30 30 35 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 63 36 61 64 39 38 38 39 32 66 31 64 34 31 31 61 36 35 66 30 30 34 30 39 36 33 32 35 31 65 35 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 37 30 63 39 }
|
||
|
|
$j = { 61 38 63 34 30 30 34 63 63 65 30 31 66 65 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
|
||
|
|
$k = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
|
||
|
|
$l = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 66 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 }
|
||
|
|
$m = { 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 30 35 30 30 30 30 30 30 30 30 30 30 30 30 7D 7B 5C 6F 62 6A 65 63 74 5C 6F 62 6A 6F 63 78 7B 7B 5C 2A 5C 6F 62 6A 64 61 74 61 31 }
|
||
|
|
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule CVE_2012_0158_2 {
|
||
|
|
meta:
|
||
|
|
author = "cabrel@zerklabs.com"
|
||
|
|
description = "RTF Stack Buffer Overflow Vulnerability"
|
||
|
|
url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
|
||
|
|
|
||
|
|
file_1 = "VAT Returns Repot 583387756.doc"
|
||
|
|
file_1_seen = "2013-05-16"
|
||
|
|
file_1_sha256 = "c6bdbe23857c0ca054d9fbc07f53ee0187b5ab6e86fea66091171e5b4268cb25"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = {30 31 30 35 30 30 30 30}
|
||
|
|
$b = {35 30 36 31 36 33 36 62 36 31 36 37 36 35 30 30}
|
||
|
|
$c = {31 36 37 37 30 33 30 30}
|
||
|
|
$d = {63 63 37 35 30 33 30 30 33 30 33 30 36 34 36 34 33 30 33 30 36 34 36 34 39 62 39 62}
|
||
|
|
$e = {32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62 32 62}
|
||
|
|
condition:
|
||
|
|
3 of ($a, $b, $c, $d, $e)
|
||
|
|
}
|
||
|
|
|
||
|
|
rule CVE_2012_0158_3 {
|
||
|
|
meta:
|
||
|
|
author = "cabrel@zerklabs.com"
|
||
|
|
description = "RTF Stack Buffer Overflow Vulnerability"
|
||
|
|
url = "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0158"
|
||
|
|
|
||
|
|
file_1_seen = "2013-05-16"
|
||
|
|
file_1_sha256 = "60523591fe426f01a22584eab6844f7537220b786e7305296dc6bf52b7101326"
|
||
|
|
|
||
|
|
file_2_seen = "2013-05-16"
|
||
|
|
file_2_sha256 = "ccb738c0ee27704dc8738483cbb99de01160ab6a99277254c446bd46c781a708"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = "Marc Klenotic" wide
|
||
|
|
|
||
|
|
$b = "JoeSoft"
|
||
|
|
$c = "RSA1"
|
||
|
|
$d = "S4Ra"
|
||
|
|
$e = "CryptoAPI Private Key" wide
|
||
|
|
$f = "Export Flag" wide
|
||
|
|
|
||
|
|
condition:
|
||
|
|
$a or ($b and $c and $d and $e and $f)
|
||
|
|
}
|
||
|
|
|
||
|
|
rule Intel_Virtualization_Wizard_exe {
|
||
|
|
meta:
|
||
|
|
author = "cabrel@zerklabs.com"
|
||
|
|
description = "Dynamic DLL abuse executable"
|
||
|
|
|
||
|
|
file_1_seen = "2013-05-21"
|
||
|
|
file_1_sha256 = "7787757ae851f4a162f46f794be1532ab78e1928185212bdab83b3106f28c708"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = {4C 6F 61 64 53 54 52 49 4E 47}
|
||
|
|
$b = {49 6E 69 74 69 61 6C 69 7A 65 4B 65 79 48 6F 6F 6B}
|
||
|
|
$c = {46 69 6E 64 52 65 73 6F 75 72 63 65 73}
|
||
|
|
$d = {4C 6F 61 64 53 54 52 49 4E 47 46 72 6F 6D 48 4B 43 55}
|
||
|
|
$e = {68 63 63 75 74 69 6C 73 2E 44 4C 4C}
|
||
|
|
condition:
|
||
|
|
all of them
|
||
|
|
}
|
||
|
|
|
||
|
|
rule Intel_Virtualization_Wizard_dll {
|
||
|
|
meta:
|
||
|
|
author = "cabrel@zerklabs.com"
|
||
|
|
description = "Dynamic DLL (Malicious)"
|
||
|
|
|
||
|
|
file_1_seen = "2013-05-21"
|
||
|
|
file_1_sha256 = "485ae043b6a5758789f1d33766a26d8b45b9fde09cde0512aa32d4bd1ee04f28"
|
||
|
|
|
||
|
|
strings:
|
||
|
|
$a = {48 3A 5C 46 61 73 74 5C 50 6C 75 67 28 68 6B 63 6D 64 29 5C}
|
||
|
|
$b = {64 6C 6C 5C 52 65 6C 65 61 73 65 5C 48 69 6A 61 63 6B 44 6C 6C 2E 70 64 62}
|
||
|
|
|
||
|
|
condition:
|
||
|
|
($a and $b) and Intel_Virtualization_Wizard_exe
|
||
|
|
}
|