Bleh

binsequencer.py samples/

[+] Extracting instructions and generating sets

	[-]samples/0001.exe
		8e^+B - 269464 instructions extracted
		.text - 11186 instructions extracted
		 - 253 instructions extracted
	[-]samples/SWIFT-COPY.exe
		T%F~$>T - 111110 instructions extracted
		.text - 10624 instructions extracted
		 - 253 instructions extracted
	[-]samples/ucheqqqqqqq.exe
		
_ - 5802 instructions extracted
		.text - 298403 instructions extracted
		 - 255 instructions extracted
	[-]samples/order.exe
		.text - 209790 instructions extracted
	[-]samples/kestDP.exe
		.text - 303292 instructions extracted
	[-]samples/Doc0254632-2018.com.exe
cd		.text - 285656 instructions extracted
	[-]samples/jesusislord.exe
		.text - 160479 instructions extracted
	[-]samples/mineboy.exe
		.text - 229798 instructions extracted

[+] Golden hash (121987 instructions) - samples/SWIFT-COPY.exe

[+] Zeroing in longest mnemonic instruction set in T%F~$>T

	[-] Matches - 0     Block Size - 4000  Time - 259.88 seconds
	[-] Matches - 0     Block Size - 2000  Time - 226.56 seconds
	[-] Matches - 0     Block Size - 1000  Time - 217.23 seconds
	[-] Matches - 0     Block Size - 500   Time - 216.30 seconds
	[-] Matches - 0     Block Size - 250   Time - 201.89 seconds
        [-] Matches - 0     Block Size - 125   Time - 183.79 seconds
	[-] Matches - 0     Block Size - 63    Time - 171.21 seconds
	[-] Matches - 0     Block Size - 32    Time - 144.23 seconds

[+] Zeroing in longest mnemonic instruction set in .text

	[-] Matches - 0     Block Size - 4000  Time - 1.55 seconds
	[-] Matches - 0     Block Size - 2000  Time - 1.83 seconds
	[-] Matches - 0     Block Size - 1000  Time - 2.05 seconds
	[-] Matches - 0     Block Size - 500   Time - 2.27 seconds
	[-] Matches - 0     Block Size - 250   Time - 2.51 seconds
	[-] Matches - 0     Block Size - 125   Time - 2.97 seconds
	[-] Matches - 0     Block Size - 63    Time - 3.53 seconds
	[-] Matches - 4     Block Size - 32    Time - 4.69 seconds
	[-] Matches - 1     Block Size - 47    Time - 3.97 seconds
	[-] Matches - 0     Block Size - 54    Time - 3.72 seconds
	[-] Matches - 0     Block Size - 51    Time - 3.84 seconds
	[-] Matches - 1     Block Size - 49    Time - 3.91 seconds
	[-] Matches - 0     Block Size - 50    Time - 3.87 seconds

	[-] Moving 1 instruction sets to review with a length of 49
	[!] Blacklisted a potentially bad match


[+] Zeroing in longest mnemonic instruction set in

	[-] Moving 21 instruction sets to review with a length of 253
	[!] Blacklisted a potentially bad match

    [*] Do you want to display matched instruction set? [Y/N] Y

    [*] Do you want to keep this set? [Y/N] Y
	[!] Blacklisted a potentially bad match

[+] Keeping 1 mnemonic set using 100 % commonality out of 8 hashes

	[-] Length - 24    Section -

[+] Printing offsets of type: longest

	[-] Gold matches

	----------v SET rule0 v----------
	inc|push|inc|jb|insd|ja|jb|sub|jb|imul|xor|add|inc|jb|insd|ja|jb|inc|imul|popal|insd|adc|dec|inc
	----------^ SET rule0 ^-----------

		samples/SWIFT-COPY.exe                                                                               0x1004b407 - 0x1004b43b in .text

	[-] Remaining matches

	----------v SET rule0 v----------
		samples/0001.exe                                                                                     0x100a9724 - 0x100a9758 in .text
		samples/ucheqqqqqqq.exe                                                                              0x1000adce - 0x1000ae02 in .text
		samples/order.exe                                                                                    0x10079e2c - 0x10079e60 in .text
		samples/kestDP.exe                                                                                   0x100aae87 - 0x100aaebb in .text
		samples/Doc0254632-2018.com.exe                                                                      0x100a2952 - 0x100a2986 in .text
		samples/jesusislord.exe                                                                              0x1005e015 - 0x1005e049 in .text
		samples/mineboy.exe                                                                                  0x100853c1 - 0x100853f5 in .text
	----------^ SET rule0 ^-----------

[+] Generating YARA rule for matches off of bytes from gold - samples/SWIFT-COPY.exe

    [*] Do you want to try and morph rule0 for accuracy and attempt to make it VT Retro friendly [Y/N] Y

[+] Check 01 - Checking for exact byte match
	[*] Exact byte match found across all samples

    [*] Do you want to include matched sample names in rule meta? [Y/N] Y

    [*] Do you want to include matched byte sequence in rule comments? [Y/N] Y

[+] Completed YARA rules

/*

SAMPLES:

samples/SWIFT-COPY.exe
samples/0001.exe
samples/Doc0254632-2018.com.exe
samples/ucheqqqqqqq.exe
samples/mineboy.exe
samples/jesusislord.exe
samples/order.exe
samples/kestDP.exe

BYTES:

45544672616D65776F726B2C56657273696F6E3D76342E300100540E144672616D65776F726B446973706C61794E616D65102E4E45

INFO:

/opt/bin/binsequencer.py samples/
Match SUCCESS for morphing

*/

rule rule0
    {
        meta:
            description = "Autogenerated by Binsequencer v.1.0.4 from samples/SWIFT-COPY.exe"
            author      = ""
            date        = "2018-08-15"

        strings:
            $rule0_bytes = { 45544672616D65776F726B2C56657273696F6E3D76342E300100540E144672616D65776F726B446973706C61794E616D65102E4E45 }

        condition:
            all of them
}