deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: phoenix_html9
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "tute)bbr:"
   $string1 = "nfho(tghRx"
   $string2 = "()irfE/Rt..cOcC"
   $string3 = "NcEnevbf"
   $string4 = "63FB8B4296BBC290A0.'0000079'Fh20216B6A6arA;<"
   $string5 = "wHe(cLnyeyet(a.i,r.{.."
   $string6 = "tute)bbdfiiix'bcr"
   $string7 = "itifdf)d1L2f'asau%d004u%8e00u%0419u%a58du%2093u%ec10u%0050u%00d4u%4622u%bcd1u%b1ceu%5000u%f7f5u%5606"
   $string8 = "2F[PII_REDACTED]'82F076676C38'te"
   $string9 = "sm(teoeoi)cfh))pihnipeeeo}.,(.(("
   $string10 = "ao)ntavlll{))ynlcoix}hiN.il'tes1ad)bm;"
   $string11 = "i)}m0f(eClei(/te"
   $string12 = "}aetsc"
   $string13 = "irefnig.pT"
   $string14 = "a0mrIif/tbne,(wsk,"
   $string15 = "500F14B[PII_REDACTED]0E6B72636F60632C6E711C6E762E646F147F44767F650A[PII_REDACTED]020009006B120005A2006L"
   $string16 = ".hB.Csf)ddeSs"
   $string17 = "tnne,IPd4Le"
   $string18 = "hMdarc'nBtpw"

Detection condition:
18 of them

Full rule:
rule phoenix_html9 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "742d012b9df0c27ed6ccf3b234db20db"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "tute)bbr:"
   $string1 = "nfho(tghRx"
   $string2 = "()irfE/Rt..cOcC"
   $string3 = "NcEnevbf"
   $string4 = "63FB8B4296BBC290A0.'0000079'Fh20216B6A6arA;<"
   $string5 = "wHe(cLnyeyet(a.i,r.{.."
   $string6 = "tute)bbdfiiix'bcr"
   $string7 = "itifdf)d1L2f'asau%d004u%8e00u%0419u%a58du%2093u%ec10u%0050u%00d4u%4622u%bcd1u%b1ceu%5000u%f7f5u%5606"
   $string8 = "2F[PII_REDACTED]'82F076676C38'te"
   $string9 = "sm(teoeoi)cfh))pihnipeeeo}.,(.(("
   $string10 = "ao)ntavlll{))ynlcoix}hiN.il'tes1ad)bm;"
   $string11 = "i)}m0f(eClei(/te"
   $string12 = "}aetsc"
   $string13 = "irefnig.pT"
   $string14 = "a0mrIif/tbne,(wsk,"
   $string15 = "500F14B[PII_REDACTED]0E6B72636F60632C6E711C6E762E646F147F44767F650A[PII_REDACTED]020009006B120005A2006L"
   $string16 = ".hB.Csf)ddeSs"
   $string17 = "tnne,IPd4Le"
   $string18 = "hMdarc'nBtpw"
condition:
   18 of them
}
YARA Detection Rule: phoenix_jar
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "r.JM,IM"
   $string1 = "qX$8$a"
   $string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
   $string3 = "a.classPK"
   $string4 = "6;\\Q]Q"
   $string5 = "h[s] X"
   $string6 = "ToolsDemoSubClass.classPK"
   $string7 = "a.class"
   $string8 = "META-INF/MANIFEST.MFPK"
   $string9 = "ToolsDemoSubClass.classeO"
   $string10 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProviderPK"

Detection condition:
10 of them

Full rule:
rule phoenix_jar : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "a8a18219b02d30f44799415ff19c518e"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "r.JM,IM"
   $string1 = "qX$8$a"
   $string2 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProvider5"
   $string3 = "a.classPK"
   $string4 = "6;\\Q]Q"
   $string5 = "h[s] X"
   $string6 = "ToolsDemoSubClass.classPK"
   $string7 = "a.class"
   $string8 = "META-INF/MANIFEST.MFPK"
   $string9 = "ToolsDemoSubClass.classeO"
   $string10 = "META-INF/services/javax.sound.midi.spi.MidiDeviceProviderPK"
condition:
   10 of them
}
YARA Detection Rule: phoenix_jar2
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "a66d578f084.classeQ"
   $string1 = "a4cb9b1a8a5.class"
   $string2 = ")szNu\\MutK"
   $string3 = "qCCwBU"
   $string4 = "META-INF/MANIFEST.MF"
   $string5 = "QR,GOX"
   $string6 = "ab5601d4848.classmT"
   $string7 = "a6a7a760c0e["
   $string8 = "2ZUK[L"
   $string9 = "2VT(Au5"
   $string10 = "a6a7a760c0ePK"
   $string11 = "aa79d1019d8.class"
   $string12 = "aa79d1019d8.classPK"
   $string13 = "META-INF/MANIFEST.MFPK"
   $string14 = "ab5601d4848.classPK"

Detection condition:
14 of them

Full rule:
rule phoenix_jar2 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "989c5b5eaddf48010e62343d7a4db6f4"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "a66d578f084.classeQ"
   $string1 = "a4cb9b1a8a5.class"
   $string2 = ")szNu\\MutK"
   $string3 = "qCCwBU"
   $string4 = "META-INF/MANIFEST.MF"
   $string5 = "QR,GOX"
   $string6 = "ab5601d4848.classmT"
   $string7 = "a6a7a760c0e["
   $string8 = "2ZUK[L"
   $string9 = "2VT(Au5"
   $string10 = "a6a7a760c0ePK"
   $string11 = "aa79d1019d8.class"
   $string12 = "aa79d1019d8.classPK"
   $string13 = "META-INF/MANIFEST.MFPK"
   $string14 = "ab5601d4848.classPK"
condition:
   14 of them
}
YARA Detection Rule: phoenix_jar3
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "'> >$>"
   $string1 = "bpac/PK"
   $string2 = "bpac/purok$1.classmP]K"
   $string3 = "bpac/KAVS.classmQ"
   $string4 = "'n n$n"
   $string5 = "bpac/purok$1.classPK"
   $string6 = "$.4aX,Gt<"
   $string7 = "bpac/KAVS.classPK"
   $string8 = "bpac/b.classPK"
   $string9 = "bpac/b.class"

Detection condition:
9 of them

Full rule:
rule phoenix_jar3 : EK Jar
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "c5655c496949f8071e41ea9ac011cab2"
   sample_filetype = "unknown"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "'> >$>"
   $string1 = "bpac/PK"
   $string2 = "bpac/purok$1.classmP]K"
   $string3 = "bpac/KAVS.classmQ"
   $string4 = "'n n$n"
   $string5 = "bpac/purok$1.classPK"
   $string6 = "$.4aX,Gt<"
   $string7 = "bpac/KAVS.classPK"
   $string8 = "bpac/b.classPK"
   $string9 = "bpac/b.class"
condition:
   9 of them
}
YARA Detection Rule: phoenix_pdf
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "[PII_REDACTED] 00000 n"
   $string1 = "[PII_REDACTED] 00000 n"
   $string2 = "trailer<</Root 1 0 R /Size 7>>"
   $string3 = "[PII_REDACTED] 65535 f"
   $string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string5 = "[PII_REDACTED] 00000 n"
   $string6 = "%PDF-1.0"
   $string7 = "startxref"
   $string8 = "[PII_REDACTED] 00000 n"
   $string9 = "endobjxref"
   $string10 = ")6 0 R ]>>endobj"
   $string11 = "[PII_REDACTED] 00000 n"

Detection condition:
11 of them

Full rule:
rule phoenix_pdf : EK PDF
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "16de68e66cab08d642a669bf377368da"
   hash1 = "bab281fe0cf3a16a396550b15d9167d5"
   sample_filetype = "pdf"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "[PII_REDACTED] 00000 n"
   $string1 = "[PII_REDACTED] 00000 n"
   $string2 = "trailer<</Root 1 0 R /Size 7>>"
   $string3 = "[PII_REDACTED] 65535 f"
   $string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string5 = "[PII_REDACTED] 00000 n"
   $string6 = "%PDF-1.0"
   $string7 = "startxref"
   $string8 = "[PII_REDACTED] 00000 n"
   $string9 = "endobjxref"
   $string10 = ")6 0 R ]>>endobj"
   $string11 = "[PII_REDACTED] 00000 n"
condition:
   11 of them
}
YARA Detection Rule: phoenix_pdf2
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "\\nQb<%"
   $string1 = "[PII_REDACTED] 00000 n"
   $string2 = ":S3>v0$EF"
   $string3 = "trailer<</Root 1 0 R /Size 7>>"
   $string4 = "%PDF-1.0"
   $string5 = "[PII_REDACTED] 65535 f"
   $string6 = "endstream"
   $string7 = "[PII_REDACTED] 00000 n"
   $string8 = "6 0 obj<</JS 7 0 R/S/JavaScript>>endobj"
   $string9 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string10 = "}pr2IE"
   $string11 = "[PII_REDACTED] 00000 n"
   $string12 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
   $string13 = "5 0 obj<</Names[("

Detection condition:
13 of them

Full rule:
rule phoenix_pdf2 : EK PDF
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "33cb6c67f58609aa853e80f718ab106a"
   sample_filetype = "pdf"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "\\nQb<%"
   $string1 = "[PII_REDACTED] 00000 n"
   $string2 = ":S3>v0$EF"
   $string3 = "trailer<</Root 1 0 R /Size 7>>"
   $string4 = "%PDF-1.0"
   $string5 = "[PII_REDACTED] 65535 f"
   $string6 = "endstream"
   $string7 = "[PII_REDACTED] 00000 n"
   $string8 = "6 0 obj<</JS 7 0 R/S/JavaScript>>endobj"
   $string9 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string10 = "}pr2IE"
   $string11 = "[PII_REDACTED] 00000 n"
   $string12 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
   $string13 = "5 0 obj<</Names[("
condition:
   13 of them
}
YARA Detection Rule: phoenix_pdf3
Repository: Yara-Rules/rules
Detects: Phoenix Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "trailer<</Root 1 0 R /Size 7>>"
   $string1 = "stream"
   $string2 = ";_oI5z"
   $string3 = "[PII_REDACTED] 00000 n"
   $string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string5 = "7 0 obj<</Filter[ /FlateDecode /ASCIIHexDecode /ASCII85Decode ]/Length 3324>>"
   $string6 = "endobjxref"
   $string7 = "L%}gE("
   $string8 = "[PII_REDACTED] 00000 n"
   $string9 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
   $string10 = "[PII_REDACTED] 00000 n"
   $string11 = "4 0 obj<</Type/Page/Parent 2 0 R /Contents 12 0 R>>endobj"

Detection condition:
11 of them

Full rule:
rule phoenix_pdf3 : EK PDF
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Phoenix Exploit Kit Detection"
   hash0 = "bab281fe0cf3a16a396550b15d9167d5"
   sample_filetype = "pdf"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "trailer<</Root 1 0 R /Size 7>>"
   $string1 = "stream"
   $string2 = ";_oI5z"
   $string3 = "[PII_REDACTED] 00000 n"
   $string4 = "3 0 obj<</JavaScript 5 0 R >>endobj"
   $string5 = "7 0 obj<</Filter[ /FlateDecode /ASCIIHexDecode /ASCII85Decode ]/Length 3324>>"
   $string6 = "endobjxref"
   $string7 = "L%}gE("
   $string8 = "[PII_REDACTED] 00000 n"
   $string9 = "1 0 obj<</Type/Catalog/Pages 2 0 R /Names 3 0 R >>endobj"
   $string10 = "[PII_REDACTED] 00000 n"
   $string11 = "4 0 obj<</Type/Page/Parent 2 0 R /Contents 12 0 R>>endobj"
condition:
   11 of them
}
YARA Detection Rule: crimepack_jar
Repository: Yara-Rules/rules
Detects: CrimePack Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "r.JM,IM"
	$string1 = "cpak/Crimepack$1.classPK"
	$string2 = "cpak/KAVS.classPK"
	$string3 = "cpak/KAVS.classmQ"
	$string4 = "cpak/Crimepack$1.classmP[O"
	$string5 = "META-INF/MANIFEST.MF"
	$string6 = "META-INF/MANIFEST.MFPK"

Detection condition:
6 of them

Full rule:
rule crimepack_jar : EK
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "CrimePack Exploit Kit Detection"
	hash0 = "d48e70d538225bc1807842ac13a8e188"
	sample_filetype = "unknown"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "r.JM,IM"
	$string1 = "cpak/Crimepack$1.classPK"
	$string2 = "cpak/KAVS.classPK"
	$string3 = "cpak/KAVS.classmQ"
	$string4 = "cpak/Crimepack$1.classmP[O"
	$string5 = "META-INF/MANIFEST.MF"
	$string6 = "META-INF/MANIFEST.MFPK"
condition:
	6 of them
}
YARA Detection Rule: crimepack_jar3
Repository: Yara-Rules/rules
Detects: CrimePack Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "payload.serPK"
	$string1 = "vE/JD[j"
	$string2 = "payload.ser["
	$string3 = "Exploit$2.classPK"
	$string4 = "Exploit$2.class"
	$string5 = "Ho((i/"
	$string6 = "META-INF/MANIFEST.MF"
	$string7 = "H5641Yk"
	$string8 = "Exploit$1.classPK"
	$string9 = "Payloader.classPK"
	$string10 = "%p6$MCS"
	$string11 = "Exploit$1$1.classPK"

Detection condition:
11 of them

Full rule:
rule crimepack_jar3 : EK
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "CrimePack Exploit Kit Detection"
	hash0 = "40ed977adc009e1593afcb09d70888c4"
	sample_filetype = "unknown"
	yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
	$string0 = "payload.serPK"
	$string1 = "vE/JD[j"
	$string2 = "payload.ser["
	$string3 = "Exploit$2.classPK"
	$string4 = "Exploit$2.class"
	$string5 = "Ho((i/"
	$string6 = "META-INF/MANIFEST.MF"
	$string7 = "H5641Yk"
	$string8 = "Exploit$1.classPK"
	$string9 = "Payloader.classPK"
	$string10 = "%p6$MCS"
	$string11 = "Exploit$1$1.classPK"
condition:
	11 of them
}
YARA Detection Rule: fragus_htm
Repository: Yara-Rules/rules
Detects: Fragus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = ">Hello, "
   $string1 = "http://www.clantemplates.com"
   $string2 = "this template was created by Bl1nk and is downloadable at <B>ClanTemplates.com<BR></B>Replace "
   $string3 = "></TD></TR></TABLE> "
   $string4 = "Image21"
   $string5 = "scrollbar etc.<BR><BR>Enjoy, Bl1nk</FONT></TD></TR></TABLE><BR></CENTER></TD></TR> "
   $string6 = "to this WarCraft Template"
   $string7 = " document.getElementById) x"
   $string8 = "    if (a[i].indexOf("
   $string9 = "x.oSrc;"
   $string10 = "x.src; x.src"
   $string11 = "<HTML>"
   $string12 = "FFFFFF"
   $string13 = " CELLSPACING"
   $string14 = "images/layoutnormal_03.gif"
   $string15 = "<TR> <TD "
   $string16 = " CELLPADDING"

Detection condition:
16 of them

Full rule:
rule fragus_htm : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Fragus Exploit Kit Detection"
   hash0 = "f76deec07a61b4276acc22beef41ea47"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = ">Hello, "
   $string1 = "http://www.clantemplates.com"
   $string2 = "this template was created by Bl1nk and is downloadable at <B>ClanTemplates.com<BR></B>Replace "
   $string3 = "></TD></TR></TABLE> "
   $string4 = "Image21"
   $string5 = "scrollbar etc.<BR><BR>Enjoy, Bl1nk</FONT></TD></TR></TABLE><BR></CENTER></TD></TR> "
   $string6 = "to this WarCraft Template"
   $string7 = " document.getElementById) x"
   $string8 = "    if (a[i].indexOf("
   $string9 = "x.oSrc;"
   $string10 = "x.src; x.src"
   $string11 = "<HTML>"
   $string12 = "FFFFFF"
   $string13 = " CELLSPACING"
   $string14 = "images/layoutnormal_03.gif"
   $string15 = "<TR> <TD "
   $string16 = " CELLPADDING"
condition:
   16 of them
}
YARA Detection Rule: fragus_js
Repository: Yara-Rules/rules
Detects: Fragus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "));ELI6Q3PZ"
   $string1 = "VGhNU2pWQmMyUXhPSFI2TTNCVGVEUXpSR3huYm1aeE5UaFhXRFI0ZFhCQVMxWkRNVGh0V0hZNFZVYzBXWFJpTVRoVFpFUklaVGxG"
   $string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
   $string3 = "TkhXa0ZrT1haNGRFSXhRM3BrTkRoVGMxZEJSMmcyT0dwNlkzSTJYM1pCYkZnMVVqQmpWMEZIYURZNGFucGpjalpmZGtGc1dERXpT"
   $string4 = "byKZKkpZU<<18"
   $string5 = ");CUer0x"
   $string6 = "bzWRebpU3yE>>16"
   $string7 = "RUJEWlVvMGNsVTVNMEpNWDNaNGJVSkpPRUJrUlVwRVQwQlNaR2cyY0ZWSE5GbDBRVFZ5UjFnMk9HVldOWGhMYUdFelRIZG5NMWQz"
   $string8 = "WnZSVGxuT1ZSRkwwaFZSelZGUm5GRlJFVTBLVHQ0UWxKQ1drdzBiWEJ5WkhSdVBtdG9XVWd6TVVGSGFFeDVTMlk3ZUVKU1FscE1O"
   $string9 = "QmZjMGN4YjBCd1oyOXBURUJJZEhvMFdYcGtOamhFV1ZwU01GVlZZbXBpUUZKV1lqTXpWMDAwY0dSNlF6aE1SekZ5ZEc4ME9FeEtN"
   $string10 = "SCpMaWXOuME("
   $string11 = "VjJKcVkxZGlYMTlhUVdRNVNUTkhaRFk0YWpsYWJsWkRNVGh0V0hZNFZVYzBXWFJ2Tm5CVmFEUlpWVmhDT0ZWV05YaDBRa1ZTUkUw"
   $string12 = "2;}else{Yuii37DWU"
   

Detection condition:
18 of them

Full rule:
rule fragus_js : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Fragus Exploit Kit Detection"
   hash0 = "f234c11b5da9a782cb1e554f520a66cf"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "));ELI6Q3PZ"
   $string1 = "VGhNU2pWQmMyUXhPSFI2TTNCVGVEUXpSR3huYm1aeE5UaFhXRFI0ZFhCQVMxWkRNVGh0V0hZNFZVYzBXWFJpTVRoVFpFUklaVGxG"
   $string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
   $string3 = "TkhXa0ZrT1haNGRFSXhRM3BrTkRoVGMxZEJSMmcyT0dwNlkzSTJYM1pCYkZnMVVqQmpWMEZIYURZNGFucGpjalpmZGtGc1dERXpT"
   $string4 = "byKZKkpZU<<18"
   $string5 = ");CUer0x"
   $string6 = "bzWRebpU3yE>>16"
   $string7 = "RUJEWlVvMGNsVTVNMEpNWDNaNGJVSkpPRUJrUlVwRVQwQlNaR2cyY0ZWSE5GbDBRVFZ5UjFnMk9HVldOWGhMYUdFelRIZG5NMWQz"
   $string8 = "WnZSVGxuT1ZSRkwwaFZSelZGUm5GRlJFVTBLVHQ0UWxKQ1drdzBiWEJ5WkhSdVBtdG9XVWd6TVVGSGFFeDVTMlk3ZUVKU1FscE1O"
   $string9 = "QmZjMGN4YjBCd1oyOXBURUJJZEhvMFdYcGtOamhFV1ZwU01GVlZZbXBpUUZKV1lqTXpWMDAwY0dSNlF6aE1SekZ5ZEc4ME9FeEtN"
   $string10 = "SCpMaWXOuME("
   $string11 = "VjJKcVkxZGlYMTlhUVdRNVNUTkhaRFk0YWpsYWJsWkRNVGh0V0hZNFZVYzBXWFJ2Tm5CVmFEUlpWVmhDT0ZWV05YaDBRa1ZTUkUw"
   $string12 = "2;}else{Yuii37DWU"
   $string13 = "ELI6Q3PZ"
   $string14 = "ZUhNNVZYQlZlRFY0UUZnMk9HMVlORkpFYkRsNGMxbEpPRUJSTVY5SGNETllPRXB0YjBsaloySnhPVVZ3UkZWQVgzTllORGgwV0RS"
   $string15 = "S05GbE1lalk0Vm1ORmVEWnpXbEpXZDBWaU5ubzJjRlkzVjFsbFgwVmlURlpuYnpCUE5HNTBhRFpaVEZrMVFYTjZObkIwWTBVNE4x"
   $string16 = "Vm5CWFFVZG9OamhxZW1OeU5sOTJRV3hZTVROSlpEWTRVM294V1VSUFFFdFdZalE0WlVjeGNsSmtObmhBYURVNFZVZEFjRlZDZGtO"
   $string17 = "Yuii37DWU<<12"
   $string18 = ";while(hdnR9eo3pZ6E3<ZZeD3LjJQ.length){eMImGB"
condition:
   18 of them
}
YARA Detection Rule: fragus_js2
Repository: Yara-Rules/rules
Detects: Fragus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "(ELI6Q3PZ"
   $string1 = "SnJTbVJqV2tOa09VbGZSMHcwY0ZWZmRrRjBjRFY0Y3psVmNGVjROWGhBV0RZNGJWZzBVa1J4TjNCVlgwVmlhRjkyZURaS1NWOUhj"
   $string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
   $string3 = "VUpKUVdWS05ISlZjMXBTTUdWRlNFQmpaMjlrVDBCTFYzY3pZbGRpZG5oeldFUndkSE16YjB4M2JXSnFZMWRpZVY4ellreDNaMko1"
   $string4 = "((Yuii37DWU"
   $string5 = "YURVNFZXUlhjRlZDZGxsQVJ6UlNaRTlBUzFkM00ySlhiekU0ZEhnMWNrUjZZM0kyWDNaQmJGZ3hNMGxrTmpoVGVqRlpkSEUyV1dW"
   $string6 = "String.fromCharCode(ZZeD3LjJQ);}else if(QIyZsvvbEmVOpp"
   $string7 = "1);ELI6Q3PZ"
   $string8 = "));Yuii37DWU"
   $string9 = ");CUer0x"
   $string10 = "T1ZaQ05IUkRTVGhqT1VWd1ZWOUpRMlZLZG5oNlQwQkxWM2N6WWxkQmRrRkFPVmR3VlRsYWJsWnNOWGhKT1ZkeFZWazFRbEU1UlZK"
   $string11 = "TlpkM2wxS3lzcExUUTRYU2s4UEhocFVqRk9jazA3SUdsbUtIaHBVakZPY2swcGV5QkdWek5NVnlzOVVrSklWVE0wVDJ0NlpTZzJP"
   $string12 = "String.fromCharCode(((eMImGB"
   $string13 = "RGRDUkV0WFV6VkJkRkV4WHpCalYwRk

Detection condition:
17 of them

Full rule:
rule fragus_js2 : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Fragus Exploit Kit Detection"
   hash0 = "f234c11b5da9a782cb1e554f520a66cf"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "(ELI6Q3PZ"
   $string1 = "SnJTbVJqV2tOa09VbGZSMHcwY0ZWZmRrRjBjRFY0Y3psVmNGVjROWGhBV0RZNGJWZzBVa1J4TjNCVlgwVmlhRjkyZURaS1NWOUhj"
   $string2 = "eFgweDNaek5YZDFkaWFtTlhZbDlmV2tGa09Va3pSMlEyT0dwSFFIQlZRblpEYzBKRWNFeGZOVmx6V0RSU1JEYzJjRlY0TVY5SFkw"
   $string3 = "VUpKUVdWS05ISlZjMXBTTUdWRlNFQmpaMjlrVDBCTFYzY3pZbGRpZG5oeldFUndkSE16YjB4M2JXSnFZMWRpZVY4ellreDNaMko1"
   $string4 = "((Yuii37DWU"
   $string5 = "YURVNFZXUlhjRlZDZGxsQVJ6UlNaRTlBUzFkM00ySlhiekU0ZEhnMWNrUjZZM0kyWDNaQmJGZ3hNMGxrTmpoVGVqRlpkSEUyV1dW"
   $string6 = "String.fromCharCode(ZZeD3LjJQ);}else if(QIyZsvvbEmVOpp"
   $string7 = "1);ELI6Q3PZ"
   $string8 = "));Yuii37DWU"
   $string9 = ");CUer0x"
   $string10 = "T1ZaQ05IUkRTVGhqT1VWd1ZWOUpRMlZLZG5oNlQwQkxWM2N6WWxkQmRrRkFPVmR3VlRsYWJsWnNOWGhKT1ZkeFZWazFRbEU1UlZK"
   $string11 = "TlpkM2wxS3lzcExUUTRYU2s4UEhocFVqRk9jazA3SUdsbUtIaHBVakZPY2swcGV5QkdWek5NVnlzOVVrSklWVE0wVDJ0NlpTZzJP"
   $string12 = "String.fromCharCode(((eMImGB"
   $string13 = "RGRDUkV0WFV6VkJkRkV4WHpCalYwRkhhRFk0YW5wamNqWmZka0ZzV0RaSWExZzBXWEZDUlZsQVpEWkJOMEoyZUhwd1duSlRXVE5J"
   $string14 = "SCpMaWXOuME(mi1mm8bu87rL0W);eval(Pcii3iVk1AG);</script></body></html>"
   $string15 = "Yuii37DWU"
   $string16 = "Yuii37DWU<<12"
   $string17 = "eTVzWlc1bmRHZ3NJRWhWUnpWRlJuRkZSRVUwUFRFd01qUXNJR2hQVlZsRVJFVmxVaXdnZUVKU1FscE1ORzF3Y21SMGJpd2dSbGN6"
condition:
   17 of them
}
YARA Detection Rule: fragus_js_flash
Repository: Yara-Rules/rules
Detects: Fragus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "document.appendChild(bdy);try{for (i"
   $string1 = "0; i<10; i"
   $string2 = "default"
   $string3 = "var m "
   $string4 = "/g, document.getElementById('divid').innerHTML));"
   $string5 = " n.substring(0,r/2);"
   $string6 = "document.getElementById('f').innerHTML"
   $string7 = "'atk' onclick"
   $string8 = "function MAKEHEAP()"
   $string9 = "document.createElement('div');"
   $string10 = "<button id"
   $string11 = "/g, document.getElementById('divid').innerHTML);"
   $string12 = "document.body.appendChild(gg);"
   $string13 = "var bdy "
   $string14 = "var gg"
   $string15 = " unescape(gg);while(n.length<r/2) { n"

Detection condition:
15 of them

Full rule:
rule fragus_js_flash : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Fragus Exploit Kit Detection"
   hash0 = "377431417b34de8592afecaea9aab95d"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "document.appendChild(bdy);try{for (i"
   $string1 = "0; i<10; i"
   $string2 = "default"
   $string3 = "var m "
   $string4 = "/g, document.getElementById('divid').innerHTML));"
   $string5 = " n.substring(0,r/2);"
   $string6 = "document.getElementById('f').innerHTML"
   $string7 = "'atk' onclick"
   $string8 = "function MAKEHEAP()"
   $string9 = "document.createElement('div');"
   $string10 = "<button id"
   $string11 = "/g, document.getElementById('divid').innerHTML);"
   $string12 = "document.body.appendChild(gg);"
   $string13 = "var bdy "
   $string14 = "var gg"
   $string15 = " unescape(gg);while(n.length<r/2) { n"
condition:
   15 of them
}
YARA Detection Rule: fragus_js_java
Repository: Yara-Rules/rules
Detects: Fragus Exploit Kit Detection
Author: Josh Berry

Pattern signatures:
$string0 = "I></XML><SPAN DATASRC"
   $string1 = "setTimeout('vparivatel()',8000);function vparivatel(){document.write('<iframe src"
   $string2 = "I DATAFLD"
   $string3 = " unescape("
   $string4 = ", 1);swf.setAttribute("
   $string5 = "function XMLNEW(){var spray "
   $string6 = "vparivatel.php"
   $string7 = "6) ){if ( (lv"
   $string8 = "'WIN 9,0,16,0')"
   $string9 = "d:/Program Files/Outlook Express/WAB.EXE"
   $string10 = "<XML ID"
   $string11 = "new ActiveXObject("
   $string12 = "'7.1.0') ){SHOWPDF('iepdf.php"
   $string13 = "function SWF(){try{sv"
   $string14 = "'WIN 9,0,28,0')"
   $string15 = "C DATAFORMATAS"
   $string16 = " shellcode;xmlcode "
   $string17 = "function SNAPSHOT(){var a"

Detection condition:
17 of them

Full rule:
rule fragus_js_java : EK
{
meta:
   author = "Josh Berry"
   date = "2016-06-26"
   description = "Fragus Exploit Kit Detection"
   hash0 = "7398e435e68a2fa31607518befef30fb"
   sample_filetype = "js-html"
   yaragenerator = "https://github.com/Xen0ph0n/YaraGenerator"
strings:
   $string0 = "I></XML><SPAN DATASRC"
   $string1 = "setTimeout('vparivatel()',8000);function vparivatel(){document.write('<iframe src"
   $string2 = "I DATAFLD"
   $string3 = " unescape("
   $string4 = ", 1);swf.setAttribute("
   $string5 = "function XMLNEW(){var spray "
   $string6 = "vparivatel.php"
   $string7 = "6) ){if ( (lv"
   $string8 = "'WIN 9,0,16,0')"
   $string9 = "d:/Program Files/Outlook Express/WAB.EXE"
   $string10 = "<XML ID"
   $string11 = "new ActiveXObject("
   $string12 = "'7.1.0') ){SHOWPDF('iepdf.php"
   $string13 = "function SWF(){try{sv"
   $string14 = "'WIN 9,0,28,0')"
   $string15 = "C DATAFORMATAS"
   $string16 = " shellcode;xmlcode "
   $string17 = "function SNAPSHOT(){var a"
condition:
   17 of them
}