deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: mpress_2_xx_x64
Repository: Yara-Rules/rules
Detects: MPRESS v2.XX x64  - no .NET
Author: Kevin Falcoz

Pattern signatures:
$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31}

Detection condition:
$signature1 at pe.entry_point

Full rule:
rule mpress_2_xx_x64 : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="19/03/2013"
		last_edit="24/03/2013"
		description="MPRESS v2.XX x64  - no .NET"

	strings:
		$signature1={57 56 53 51 52 41 50 48 8D 05 DE 0A 00 00 48 8B 30 48 03 F0 48 2B C0 48 8B FE 66 AD C1 E0 0C 48 8B C8 50 AD 2B C8 48 03 F1 8B C8 57 44 8B C1 FF C9 8A 44 39 06 88 04 31}

	condition:
		$signature1 at pe.entry_point
}
YARA Detection Rule: mpress_2_xx_net
Repository: Yara-Rules/rules
Detects: MPRESS v2.XX .NET
Author: Kevin Falcoz

Pattern signatures:
$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}

Detection condition:
$signature1

Full rule:
rule mpress_2_xx_net : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="24/03/2013"
		description="MPRESS v2.XX .NET"

	strings:
		$signature1={21 46 00 69 00 6C 00 65 00 20 00 69 00 73 00 20 00 69 00 6E 00 76 00 61 00 6C 00 69 00 64 00 2E 00 00 0D 4D 00 50 00 52 00 45 00 53 00 53 00 00 00 00 00 2D 2D 93 6B 35 04 2E 43 85 EF}

	condition:
		$signature1
}
YARA Detection Rule: rpx_1_xx
Repository: Yara-Rules/rules
Detects: RPX v1.XX
Author: Kevin Falcoz

Pattern signatures:
$signature1= "RPX 1."
		$signature2= "Copyright 20"

Detection condition:
$signature1 and $signature2

Full rule:
rule rpx_1_xx : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="24/03/2013"
		description="RPX v1.XX"

	strings:
		$signature1= "RPX 1."
		$signature2= "Copyright 20"

	condition:
		$signature1 and $signature2
}
YARA Detection Rule: mew_11_xx
Repository: Yara-Rules/rules
Detects: MEW 11
Author: Kevin Falcoz

Pattern signatures:
$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
		$signature2="MEW"

Detection condition:
$signature1 and $signature2

Full rule:
rule mew_11_xx : Packer
{
	meta:
		author="Kevin Falcoz"
		date_create="25/03/2013"
		description="MEW 11"

	strings:
		$signature1={50 72 6F 63 41 64 64 72 65 73 73 00 E9 [6-7] 00 00 00 00 00 00 00 00 00 [7] 00}
		$signature2="MEW"

	condition:
		$signature1 and $signature2
}
YARA Detection Rule: yoda_crypter_1_2
Repository: Yara-Rules/rules
Detects: Yoda Crypter 1.2
Author: Kevin Falcoz

Pattern signatures:
$signature1={60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [19] EB 01 [27] AA E2 CC}

Detection condition:
$signature1 at pe.entry_point

Full rule:
rule yoda_crypter_1_2 : Crypter
{
	meta:
		author="Kevin Falcoz"
		date_create="15/04/2013"
		description="Yoda Crypter 1.2"

	strings:
		$signature1={60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [19] EB 01 [27] AA E2 CC}

	condition:
		$signature1 at pe.entry_point
}
YARA Detection Rule: yoda_crypter_1_3
Repository: Yara-Rules/rules
Detects: Yoda Crypter 1.3
Author: Kevin Falcoz

Pattern signatures:
$signature1={55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}

Detection condition:
$signature1 at pe.entry_point

Full rule:
rule yoda_crypter_1_3 : Crypter
{
	meta:
		author="Kevin Falcoz"
		date_create="15/04/2013"
		description="Yoda Crypter 1.3"

	strings:
		$signature1={55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC}

	condition:
		$signature1 at pe.entry_point
}
YARA Detection Rule: dotfuscator
Repository: Yara-Rules/rules
Detects: Dotfuscator
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = "Obfuscated with Dotfuscator"

Detection condition:
$a

Full rule:
rule dotfuscator : packer
{
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "Dotfuscator"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0"

	strings:
		$a = "Obfuscated with Dotfuscator"

	condition:
		$a
}
YARA Detection Rule: AutoIt_2
Repository: Yara-Rules/rules
Detects: AutoIT packer
Author: Jean-Philippe Teissier / @Jipe_

Pattern signatures:
$a = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."

Detection condition:
$a

Full rule:
rule AutoIt_2 : packer
{
	meta:
		author = "Jean-Philippe Teissier / @Jipe_"
		description = "AutoIT packer"
		date = "2013-02-01"
		filetype = "memory"
		version = "1.0"

	strings:
		$a = "This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support."

	condition:
		$a
}
YARA Detection Rule: mumblehard_packer
Repository: Yara-Rules/rules
Detects: Mumblehard i386 assembly code responsible for decrypting Perl code
Author: Marc-Etienne M.Leveille
Reference: http://www.welivesecurity.com

Pattern signatures:
$decrypt = { 31 db [1-10] ba ?? 00 00 00 [0-6] (56 5f | 89 F7) 39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00 00 31 db 43 ac 30 d8 aa 43 e2 e2 }

Detection condition:
$decrypt

Full rule:
rule mumblehard_packer
{
    meta:
        description = "Mumblehard i386 assembly code responsible for decrypting Perl code"
        author = "Marc-Etienne M.Leveille"
        date = "2015-04-07"
        reference = "http://www.welivesecurity.com"
        version = "1"

    strings:

	$decrypt = { 31 db [1-10] ba ?? 00 00 00 [0-6] (56 5f | 89 F7) 39 d3 75 13 81 fa ?? 00 00 00 75 02 31 d2 81 c2 ?? 00 00 00 31 db 43 ac 30 d8 aa 43 e2 e2 }

    condition:
        $decrypt
}
YARA Detection Rule: zeroaccess_css
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "close-mail{right:130px "
   $string1 = "ccc;box-shadow:0 0 5px 1px "
   $string2 = "757575;border-bottom:1px solid "
   $string3 = "777;height:1.8em;line-height:1.9em;display:block;float:left;padding:1px 15px;margin:0;text-shadow:-1"
   $string4 = "C4C4C4;}"
   $string5 = "999;-webkit-box-shadow:0 0 3px "
   $string6 = "header div.service-links ul{display:inline;margin:10px 0 0;}"
   $string7 = "t div h2.title{padding:0;margin:0;}.box5-condition-news h2.pane-title{display:block;margin:0 0 9px;p"
   $string8 = "footer div.comp-info p{color:"
   $string9 = "pcmi-listing-center .full-page-listing{width:490px;}"
   $string10 = "pcmi-content-top .photo img,"
   $string11 = "333;}div.tfw-header a var{display:inline-block;margin:0;line-height:20px;height:20px;width:120px;bac"
   $string12 = "ay:none;text-decoration:none;outline:none;padding:4px;text-align:center;font-size:9px;color:"
   $string13 = "333;}body.page-videoplayer div"
   $string14 = "373737;position:relative;}body.nod

Detection condition:
18 of them

Full rule:
rule zeroaccess_css : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "4944324bad3b020618444ee131dce3d0"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "close-mail{right:130px "
   $string1 = "ccc;box-shadow:0 0 5px 1px "
   $string2 = "757575;border-bottom:1px solid "
   $string3 = "777;height:1.8em;line-height:1.9em;display:block;float:left;padding:1px 15px;margin:0;text-shadow:-1"
   $string4 = "C4C4C4;}"
   $string5 = "999;-webkit-box-shadow:0 0 3px "
   $string6 = "header div.service-links ul{display:inline;margin:10px 0 0;}"
   $string7 = "t div h2.title{padding:0;margin:0;}.box5-condition-news h2.pane-title{display:block;margin:0 0 9px;p"
   $string8 = "footer div.comp-info p{color:"
   $string9 = "pcmi-listing-center .full-page-listing{width:490px;}"
   $string10 = "pcmi-content-top .photo img,"
   $string11 = "333;}div.tfw-header a var{display:inline-block;margin:0;line-height:20px;height:20px;width:120px;bac"
   $string12 = "ay:none;text-decoration:none;outline:none;padding:4px;text-align:center;font-size:9px;color:"
   $string13 = "333;}body.page-videoplayer div"
   $string14 = "373737;position:relative;}body.node-type-video div"
   $string15 = "pcmi-content-sidebara,.page-error-page "
   $string16 = "fff;text-decoration:none;}"
   $string17 = "qtabs-list li a,"
   $string18 = "cdn2.dailyrx.com"
condition:
   18 of them
}
YARA Detection Rule: zeroaccess_css2
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "er div.panel-hide{display:block;position:absolute;z-index:200;margin-top:-1.5em;}div.panel-pane div."
   $string1 = "ve.gif) right center no-repeat;}div.ctools-ajaxing{float:left;width:18px;background:url(http://cdn3."
   $string2 = "cdn2.dailyrx.com"
   $string3 = "efefef;margin:5px 0 5px 0;}"
   $string4 = "node{margin:0;padding:0;}div.panel-pane div.feed a{float:right;}"
   $string5 = ":0 5px 0 0;float:left;}div.tweets-pulled-listing div.tweet-authorphoto img{max-height:40px;max-width"
   $string6 = "i a{color:"
   $string7 = ":bold;}div.tweets-pulled-listing .tweet-time a{color:silver;}div.tweets-pulled-listing  div.tweet-di"
   $string8 = "div.panel-pane div.admin-links{font-size:xx-small;margin-right:1em;}div.panel-pane div.admin-links l"
   $string9 = "div.tweets-pulled-listing ul{list-style:none;}div.tweets-pulled-listing div.tweet-authorphoto{margin"
   $string10 = "FFFFDD none repeat scroll 0 0;border:1px solid "
   $string11 = "vider{clear:left;border-bottom:1px 

Detection condition:
11 of them

Full rule:
rule zeroaccess_css2 : EK css
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "e300d6a36b9bfc3389f64021e78b1503"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "er div.panel-hide{display:block;position:absolute;z-index:200;margin-top:-1.5em;}div.panel-pane div."
   $string1 = "ve.gif) right center no-repeat;}div.ctools-ajaxing{float:left;width:18px;background:url(http://cdn3."
   $string2 = "cdn2.dailyrx.com"
   $string3 = "efefef;margin:5px 0 5px 0;}"
   $string4 = "node{margin:0;padding:0;}div.panel-pane div.feed a{float:right;}"
   $string5 = ":0 5px 0 0;float:left;}div.tweets-pulled-listing div.tweet-authorphoto img{max-height:40px;max-width"
   $string6 = "i a{color:"
   $string7 = ":bold;}div.tweets-pulled-listing .tweet-time a{color:silver;}div.tweets-pulled-listing  div.tweet-di"
   $string8 = "div.panel-pane div.admin-links{font-size:xx-small;margin-right:1em;}div.panel-pane div.admin-links l"
   $string9 = "div.tweets-pulled-listing ul{list-style:none;}div.tweets-pulled-listing div.tweet-authorphoto{margin"
   $string10 = "FFFFDD none repeat scroll 0 0;border:1px solid "
   $string11 = "vider{clear:left;border-bottom:1px solid "
condition:
   11 of them
}
YARA Detection Rule: zeroaccess_htm
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "screen.height:"
   $string1 = "</script></head><body onload"
   $string2 = "Fx0ZAQRKXUVgbh0qNDRJVxYwGg4tGh8aHQoAVQQSNyo0NElXFjAaDi0NFQYESl1FBBNnTFoSPiBmADwnPTQxPSdKWUUEE2UcGR0z"
   $string3 = "0);-10<b"
   $string4 = "function fl(){var a"
   $string5 = "0);else if(navigator.mimeTypes"
   $string6 = ");b.href"
   $string7 = "/presults.jsp"
   $string8 = "128.164.107.221"
   $string9 = ")[0].clientWidth"
   $string10 = "presults.jsp"
   $string11 = ":escape(c),e"
   $string12 = "navigator.plugins.length)navigator.plugins["
   $string13 = "window;d"
   $string14 = "gr(),j"
   $string15 = "VIEWPORT"
   $string16 = "FQV2D0ZAH1VGDxgZVg9COwYCAwkcTzAcBxscBFoKAAMHUFVuWF5EVVYVdVtUR18bA1QdAU8HQjgeUFYeAEZ4SBEcEk1FTxsdUlVA"

Detection condition:
16 of them

Full rule:
rule zeroaccess_htm : EK html
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "0e7d72749b60c8f05d4ff40da7e0e937"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "screen.height:"
   $string1 = "</script></head><body onload"
   $string2 = "Fx0ZAQRKXUVgbh0qNDRJVxYwGg4tGh8aHQoAVQQSNyo0NElXFjAaDi0NFQYESl1FBBNnTFoSPiBmADwnPTQxPSdKWUUEE2UcGR0z"
   $string3 = "0);-10<b"
   $string4 = "function fl(){var a"
   $string5 = "0);else if(navigator.mimeTypes"
   $string6 = ");b.href"
   $string7 = "/presults.jsp"
   $string8 = "128.164.107.221"
   $string9 = ")[0].clientWidth"
   $string10 = "presults.jsp"
   $string11 = ":escape(c),e"
   $string12 = "navigator.plugins.length)navigator.plugins["
   $string13 = "window;d"
   $string14 = "gr(),j"
   $string15 = "VIEWPORT"
   $string16 = "FQV2D0ZAH1VGDxgZVg9COwYCAwkcTzAcBxscBFoKAAMHUFVuWF5EVVYVdVtUR18bA1QdAU8HQjgeUFYeAEZ4SBEcEk1FTxsdUlVA"
condition:
   16 of them
}
YARA Detection Rule: zeroaccess_js
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "Square ad tag  (tile"
   $string1 = "  adRandNum "
   $string2 = " cellspacing"
   $string3 = "\\n//-->\\n</script>"
   $string4 = "format"
   $string5 = "//-->' "
   $string6 = "[PII_REDACTED]"
   $string7 = "NoScrBeg "
   $string8 = "-- start adblade -->' "
   $string9 = "[PII_REDACTED]"
   $string10 = "        while (i >"
   $string11 = "return '<table width"
   $string12 = "</scr' "
   $string13 = " s.substring(0, i"
   $string14 = " /></a></noscript>' "
   $string15 = "    else { isEmail "
   $string16 = ").submit();"
   $string17 = " border"
   $string18 = "pub-[PII_REDACTED]"

Detection condition:
18 of them

Full rule:
rule zeroaccess_js : EK js
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "a9f30483a197cfdc65b4a70b8eb738ab"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "Square ad tag  (tile"
   $string1 = "  adRandNum "
   $string2 = " cellspacing"
   $string3 = "\\n//-->\\n</script>"
   $string4 = "format"
   $string5 = "//-->' "
   $string6 = "[PII_REDACTED]"
   $string7 = "NoScrBeg "
   $string8 = "-- start adblade -->' "
   $string9 = "[PII_REDACTED]"
   $string10 = "        while (i >"
   $string11 = "return '<table width"
   $string12 = "</scr' "
   $string13 = " s.substring(0, i"
   $string14 = " /></a></noscript>' "
   $string15 = "    else { isEmail "
   $string16 = ").submit();"
   $string17 = " border"
   $string18 = "pub-[PII_REDACTED]"
condition:
   18 of them
}
YARA Detection Rule: zeroaccess_js2
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "ApiClientConfig"
   $string1 = "function/.test(pa.toString())"
   $string2 = "background-image:url(http:\\/\\/static.ak.fbcdn.net\\/rsrc.php\\/v2\\/y6\\/x\\/s816eWC-2sl.gif)}"
   $string3 = "Music.init"
   $string4 = "',header:'bool',recommendations:'bool',site:'hostname'},create_event_button:{},degrees:{href:'url'},"
   $string5 = "cca6477272fc5cb805f85a84f20fca1d"
   $string6 = "document.createElement('form');c.action"
   $string7 = "javascript:false"
   $string8 = "s.onMessage){j.error('An instance without whenReady or onMessage makes no sense');throw new Error('A"
   $string9 = "NaN;}else h"
   $string10 = "sprintf"
   $string11 = "window,j"
   $string12 = "o.getUserID(),da"
   $string13 = "FB.Runtime.getLoginStatus();if(b"
   $string14 = ")');k.toString"
   $string15 = "rovide('XFBML.Send',{Dimensions:{width:80,height:25}});"
   $string16 = "{log:i};e.exports"
   $string17 = "a;FB.api('/fql','GET',f,function(g){if(g.error){ES5(ES5('Object','keys',false,b),'forEach',tru

Detection condition:
18 of them

Full rule:
rule zeroaccess_js2 : EK js
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "b5fda04856b98c254d33548cc1c1216c"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "ApiClientConfig"
   $string1 = "function/.test(pa.toString())"
   $string2 = "background-image:url(http:\\/\\/static.ak.fbcdn.net\\/rsrc.php\\/v2\\/y6\\/x\\/s816eWC-2sl.gif)}"
   $string3 = "Music.init"
   $string4 = "',header:'bool',recommendations:'bool',site:'hostname'},create_event_button:{},degrees:{href:'url'},"
   $string5 = "cca6477272fc5cb805f85a84f20fca1d"
   $string6 = "document.createElement('form');c.action"
   $string7 = "javascript:false"
   $string8 = "s.onMessage){j.error('An instance without whenReady or onMessage makes no sense');throw new Error('A"
   $string9 = "NaN;}else h"
   $string10 = "sprintf"
   $string11 = "window,j"
   $string12 = "o.getUserID(),da"
   $string13 = "FB.Runtime.getLoginStatus();if(b"
   $string14 = ")');k.toString"
   $string15 = "rovide('XFBML.Send',{Dimensions:{width:80,height:25}});"
   $string16 = "{log:i};e.exports"
   $string17 = "a;FB.api('/fql','GET',f,function(g){if(g.error){ES5(ES5('Object','keys',false,b),'forEach',true,func"
   $string18 = "true;}}var ia"
condition:
   18 of them
}
YARA Detection Rule: zeroaccess_js3
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "document.createDocumentFragment();img.src"
   $string1 = "typeOf(events)"
   $string2 = "var i,x,y,ARRcookies"
   $string3 = "callbacks.length;j<l;j"
   $string4 = "encodeURIComponent(value);if(options.domain)value"
   $string5 = "event,HG.components.get('windowEvent_'"
   $string6 = "'read'in Cookie){return Cookie.read(c_name);}"
   $string7 = "item;},get:function(name,def){return HG.components.exists(name)"
   $string8 = "){window.addEvent(windowEvents[i],function(){var callbacks"
   $string9 = "reunload:function(callback){HG.events.add('beforeunload',callback);},add:function(event,callback){HG"
   $string10 = "name){if(HG.components.exists(name)){delete HG.componentList[name];}}},util:{uuid:function(){return'"
   $string11 = "window.HG"
   $string12 = "x.replace(/"
   $string13 = "encodeURIComponent(this.attr[key]));}"
   $string14 = "options.domain;if(options.path)value"
   $string15 = "this.page_sid;this.attr.user_sid"

Detection condition:
15 of them

Full rule:
rule zeroaccess_js3 : EK js
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "5f13fdfb53a3e60e93d7d1d7bbecff4f"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "document.createDocumentFragment();img.src"
   $string1 = "typeOf(events)"
   $string2 = "var i,x,y,ARRcookies"
   $string3 = "callbacks.length;j<l;j"
   $string4 = "encodeURIComponent(value);if(options.domain)value"
   $string5 = "event,HG.components.get('windowEvent_'"
   $string6 = "'read'in Cookie){return Cookie.read(c_name);}"
   $string7 = "item;},get:function(name,def){return HG.components.exists(name)"
   $string8 = "){window.addEvent(windowEvents[i],function(){var callbacks"
   $string9 = "reunload:function(callback){HG.events.add('beforeunload',callback);},add:function(event,callback){HG"
   $string10 = "name){if(HG.components.exists(name)){delete HG.componentList[name];}}},util:{uuid:function(){return'"
   $string11 = "window.HG"
   $string12 = "x.replace(/"
   $string13 = "encodeURIComponent(this.attr[key]));}"
   $string14 = "options.domain;if(options.path)value"
   $string15 = "this.page_sid;this.attr.user_sid"
condition:
   15 of them
}
YARA Detection Rule: zeroaccess_js4
Repository: Yara-Rules/rules
Detects: ZeroAccess Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = ").join("
   $string1 = "JSON.stringify:function(o){if(o"
   $string2 = "){try{var a"
   $string3 = ");return $.jqotecache[i]"
   $string4 = "o.getUTCFullYear(),hours"
   $string5 = "seconds"
   $string6 = "')');};$.secureEvalJSON"
   $string7 = "isFinite(n);},secondsToTime:function(sec_numb){sec_numb"
   $string8 = "')');}else{throw new SyntaxError('Error parsing JSON, source is not valid.');}};$.quoteString"
   $string9 = "o[name];var ret"
   $string10 = "a[m].substr(2)"
   $string11 = ");if(d){return true;}}}catch(e){return false;}}"
   $string12 = "a.length;m<k;m"
   $string13 = "if(parentClasses.length"
   $string14 = "o.getUTCHours(),minutes"
   $string15 = "$.jqote(e,d,t),$$"
   $string16 = "q.test(x)){e"
   $string17 = "{};HGWidget.creator"

Detection condition:
17 of them

Full rule:
rule zeroaccess_js4 : EK js
{
meta:
   author = "Josh Berry"
   date = "2016-06-27"
   description = "ZeroAccess Exploit Kit Detection"
   hash0 = "268ae96254e423e9d670ebe172d1a444"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = ").join("
   $string1 = "JSON.stringify:function(o){if(o"
   $string2 = "){try{var a"
   $string3 = ");return $.jqotecache[i]"
   $string4 = "o.getUTCFullYear(),hours"
   $string5 = "seconds"
   $string6 = "')');};$.secureEvalJSON"
   $string7 = "isFinite(n);},secondsToTime:function(sec_numb){sec_numb"
   $string8 = "')');}else{throw new SyntaxError('Error parsing JSON, source is not valid.');}};$.quoteString"
   $string9 = "o[name];var ret"
   $string10 = "a[m].substr(2)"
   $string11 = ");if(d){return true;}}}catch(e){return false;}}"
   $string12 = "a.length;m<k;m"
   $string13 = "if(parentClasses.length"
   $string14 = "o.getUTCHours(),minutes"
   $string15 = "$.jqote(e,d,t),$$"
   $string16 = "q.test(x)){e"
   $string17 = "{};HGWidget.creator"
condition:
   17 of them
}
YARA Detection Rule: zerox88_js2
Repository: Yara-Rules/rules
Detects: 0x88 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "function gSH() {"
	$string1 = "200 HEIGHT"
	$string2 = "'sh.js'><\\/SCRIPT>"
	$string3 = " 2 - 26;"
	$string4 = "<IFRAME ID"
	$string5 = ",100);"
	$string6 = "200></IFRAME>"
	$string7 = "setTimeout("
	$string8 = "'about:blank' WIDTH"
	$string9 = "mf.document.write("
	$string10 = "document.write("
	$string11 = "Kasper "

Detection condition:
11 of them

Full rule:
rule zerox88_js2
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "0x88 Exploit Kit Detection"
	hash0 = "cad8b652338f5e3bc93069c8aa329301"
	sample_filetype = "js-html"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "function gSH() {"
	$string1 = "200 HEIGHT"
	$string2 = "'sh.js'><\\/SCRIPT>"
	$string3 = " 2 - 26;"
	$string4 = "<IFRAME ID"
	$string5 = ",100);"
	$string6 = "200></IFRAME>"
	$string7 = "setTimeout("
	$string8 = "'about:blank' WIDTH"
	$string9 = "mf.document.write("
	$string10 = "document.write("
	$string11 = "Kasper "
condition:
	11 of them
}
YARA Detection Rule: zerox88_js3
Repository: Yara-Rules/rules
Detects: 0x88 Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = " new ActiveXObject(szHTTP); "
	$string1 = " Csa2;"
	$string2 = "var ADO "
	$string3 = " new ActiveXObject(szOx88);"
	$string4 = " unescape("
	$string5 = "/test.exe"
	$string6 = " szEtYij;"
	$string7 = "var HTTP "
	$string8 = "%41%44%4F%44%42%2E"
	$string9 = "%4D%65%64%69%61"
	$string10 = "var szSRjq"
	$string11 = "%43%3A%5C%5C%50%72%6F%67%72%61%6D"
	$string12 = "var METHOD "
	$string13 = "ADO.Mode "
	$string14 = "%61%79%65%72"
	$string15 = "%2E%58%4D%4C%48%54%54%50"
	$string16 = " 7 - 6; HTTP.Open(METHOD, szURL, i-3); "

Detection condition:
16 of them

Full rule:
rule zerox88_js3
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "0x88 Exploit Kit Detection"
	hash0 = "9df0ac2fa92e602ec11bac53555e2d82"
	sample_filetype = "js-html"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = " new ActiveXObject(szHTTP); "
	$string1 = " Csa2;"
	$string2 = "var ADO "
	$string3 = " new ActiveXObject(szOx88);"
	$string4 = " unescape("
	$string5 = "/test.exe"
	$string6 = " szEtYij;"
	$string7 = "var HTTP "
	$string8 = "%41%44%4F%44%42%2E"
	$string9 = "%4D%65%64%69%61"
	$string10 = "var szSRjq"
	$string11 = "%43%3A%5C%5C%50%72%6F%67%72%61%6D"
	$string12 = "var METHOD "
	$string13 = "ADO.Mode "
	$string14 = "%61%79%65%72"
	$string15 = "%2E%58%4D%4C%48%54%54%50"
	$string16 = " 7 - 6; HTTP.Open(METHOD, szURL, i-3); "
condition:
	16 of them
}