SHARE
TWEET

NSIS DLL loader

James_inthe_box Jan 13th, 2019 (edited) 301 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule NSIS_called_dll
  2. {
  3.     meta:
  4.         description = "NSIS_called_dll"
  5.         author = "James_inthe_box"
  6.         reference = "https://app.any.run/tasks/a1be5611-57aa-43ef-b1bd-55efe397a593"
  7.         date = "2019/01"
  8.         maltype = "Unknown"
  9.  
  10.     strings:
  11.         $string1 = "WaitForSingleObject"
  12.         $string2 = "winapp"
  13.         $string3 = "CreateMutexA"
  14.         $string4 = "GetCurrentProcessId"
  15.         $string5 = "_load4@0"
  16.         $string6 = "OpenProcess"
  17.         $string7 = "KERNEL32.dll"
  18.  
  19.     condition:
  20.         uint16(0) == 0x5A4D and uint8(uint32(0x3c)+23) == 0x21 and (all of ($string*))
  21. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top