YARA Detection Rule: Win32_Virus_DeadCode
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Yara rule that detects DeadCode virus.
Malware family: DEADCODE
Author: ReversingLabs

Pattern signatures:
$deadcode_ep_1 = {
            64 67 FF 36 30 00 58 8B 40 08 FF 70 48 5B FF 70 4C 5A 03 40 44 
            FF E0 
        }
        
        $deadcode_marker = {
            DE C0 AD DE
        }
  
        $deadcode_ep_2 = {
            2B C0 85 C0 74 0E 64 67 FF 36 00 00 64 67 89 26 00 00 89 00 E8 
            ED FF FF FF 8B 74 24 0C 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 
            4C 03 40 44 89 86 B8 00 00 00 89 86 B0 00 00 00 89 9E A4 00 00 
            00 89 96 A8 00 00 00 2B C0 C3
        }
  
        $deadcode_ep_3 = {
            B8 DE C0 AD DE 50 5A 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 4C
            03 40 44 FF D0
        }

        $deadcode_body_1 = {
            8B D0 8B EA 81 C5 ?? ?? ?? ?? 89 85 A4 00 00 00 89 9D C0 00 00 00 E8 56 01 00 00 89
            45 00 8D 75 04 81 C2 ?? ?? ?? ?? 6A 19 FF 75 00 52 56 E8 CE 01 00 00 64 67 A1 30 00 
            8B 40 08 89 85 88 00 00 00 C7 85 D0 00 00 00 ?? ?? ?? ?? E8 09 00 00 00 8B 64 24 08 
            E9 03 01 00 00 33 D2

Detection condition:
uint16(0) == 0x5A4D and 
        ((($deadcode_ep_1 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        (($deadcode_ep_2 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        (($deadcode_ep_3 at pe.entry_point) and ($deadcode_marker at 0x40)) or
        ($deadcode_body_1 and $deadco

Full rule:
rule Win32_Virus_DeadCode : tc_detection malicious
{
    meta:

        author              = "ReversingLabs"

        source              = "ReversingLabs"
        status              = "RELEASED"
        sharing             = "TLP:WHITE"
        category            = "MALWARE"
        malware             = "DEADCODE"
        description         = "Yara rule that detects DeadCode virus."

        tc_detection_type   = "Virus"
        tc_detection_name   = "DeadCode"
        tc_detection_factor = 5

    strings:
        $deadcode_ep_1 = {
            64 67 FF 36 30 00 58 8B 40 08 FF 70 48 5B FF 70 4C 5A 03 40 44 
            FF E0 
        }
        
        $deadcode_marker = {
            DE C0 AD DE
        }
  
        $deadcode_ep_2 = {
            2B C0 85 C0 74 0E 64 67 FF 36 00 00 64 67 89 26 00 00 89 00 E8 
            ED FF FF FF 8B 74 24 0C 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 
            4C 03 40 44 89 86 B8 00 00 00 89 86 B0 00 00 00 89 9E A4 00 00 
            00 89 96 A8 00 00 00 2B C0 C3
        }
  
        $deadcode_ep_3 = {
            B8 DE C0 AD DE 50 5A 64 67 A1 30 00 8B 40 08 8B 58 48 8B 50 4C
            03 40 44 FF D0
        }

        $deadcode_body_1 = {
            8B D0 8B EA 81 C5 ?? ?? ?? ?? 89 85 A4 00 00 00 89 9D C0 00 00 00 E8 56 01 00 00 89
            45 00 8D 75 04 81 C2 ?? ?? ?? ?? 6A 19 FF 75 00 52 56 E8 CE 01 00 00 64 67 A1 30 00 
            8B 40 08 89 85 88 00 00 00 C7 85 D0 00 00 00 ?? ?? ?? ?? E8 09 00 00 00 8B 64 24 08 
            E9 03 01 00 00 33 D2 64 FF 32 64 89 22 83 BD C0 00 00 00 00 75 2F 6A 04 68 00 10 00 
            00 68 40 01 00 00 6A 00 FF 55 08 50 8F 45 78 E8 2A 03 00 00 68 00 40 00 00 68 40 01 
            00 00 FF 75 78 FF 55 28 E9 C3 00 00 00 8B 85 A4 00 00 00 05 ?? ?? ?? ?? 8D B5 B4 00 
            00 00 56 6A 00 55 50 68 00 00 10 00 6A 00 FF 55 30 89 85 AC 00 00 00 6A 04 68 00 10 
            00 00 6A 54 6A 00 FF 55 08 89 85 A8 00 00 00 64 67 A1 30 00 8B 40 10 8B 40 3C 8B B5
            A8 00 00 0