deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: APT30_Sample_4
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "GetStartupIn" ascii
		$s1 = "enMutex" ascii
		$s2 = "tpsvimi" ascii
		$s3 = "reateProcesy" ascii
		$s5 = "FreeLibr1y*S" ascii
		$s6 = "foAModuleHand" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_4 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "75367d8b506031df5923c2d8d7f1b9f643a123cd"
		id = "e5c6afde-0ab5-54ed-8d18-5ad477a527d7"
	strings:
		$s0 = "GetStartupIn" ascii
		$s1 = "enMutex" ascii
		$s2 = "tpsvimi" ascii
		$s3 = "reateProcesy" ascii
		$s5 = "FreeLibr1y*S" ascii
		$s6 = "foAModuleHand" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_5
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s7 = "msmsgs" fullword wide
		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_5 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "1a2dd2a0555dc746333e7c956c58f7c4cdbabd4b"
		id = "bdbebe44-7423-5793-8a42-4f9b70de2231"
	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s3 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s7 = "msmsgs" fullword wide
		$s10 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_6
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "GreateProcessA" fullword ascii
		$s1 = "Ternel32.dll" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_6 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "00e69b059ad6b51b76bc476a115325449d10b4c0"
		id = "2f19809c-09fc-51bf-9a20-6b95099a92dd"
	strings:
		$s0 = "GreateProcessA" fullword ascii
		$s1 = "Ternel32.dll" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_7
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "datain" fullword ascii
		$s3 = "C:\\Prog" ascii
		$s4 = "$LDDATA$" ascii
		$s5 = "Maybe a Encrypted Flash" fullword ascii
		$s6 = "Jean-loup Gailly" ascii
		$s8 = "deflate 1.1.3 Copyright" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_7 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "868d1f4c106a08bd2e5af4f23139f0e0cd798fba"
		id = "612732d9-8df5-5388-b299-2da4f8118435"
	strings:
		$s0 = "datain" fullword ascii
		$s3 = "C:\\Prog" ascii
		$s4 = "$LDDATA$" ascii
		$s5 = "Maybe a Encrypted Flash" fullword ascii
		$s6 = "Jean-loup Gailly" ascii
		$s8 = "deflate 1.1.3 Copyright" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_E
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Nkfvtyvn}" ascii
		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_E {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "1dbb584e19499e26398fb0a7aa2a01b7"
		hash2 = "572c9cd[PII_REDACTED]c0b2edb7c6f5e25"
		hash3 = "8ff473bedbcc77df2c49a91167b1abeb"
		hash4 = "a813eba27b2166620bd75029cc1f04b0"
		hash5 = "b5546842e08950bc17a438d785b5a019"
		id = "69e76a59-3529-541d-9017-07e6d67fbda4"
	strings:
		$s0 = "Nkfvtyvn}" ascii
		$s6 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_8
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "ateProcessA" ascii
		$s1 = "Ternel32.dllFQ" fullword ascii
		$s2 = "StartupInfoAModuleHand" fullword ascii
		$s3 = "OpenMutex" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_8 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "9531e21652143b8b129ab8c023dc05fef2a17cc3"
		id = "5053c2db-32a9-58ae-9a72-eb16ef14168e"
	strings:
		$s0 = "ateProcessA" ascii
		$s1 = "Ternel32.dllFQ" fullword ascii
		$s2 = "StartupInfoAModuleHand" fullword ascii
		$s3 = "OpenMutex" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_B
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s2 = "Moziea/4.0" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_B {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "0fcb4ffe2eb391421ec876286c9ddb6c"
		hash2 = "29395c528693b69233c1c12bef8a64b3"
		hash3 = "4c6b21e98ca03e0ef0910e07cef45dac"
		hash4 = "550459b31d8dabaad1923565b7e50242"
		hash5 = "65232a8d555d7c4f7bc0d7c5da08c593"
		hash6 = "853a20f5fc6d16202828df132c41a061"
		hash7 = "ed151602dea80f39173c2f7b1dd58e06"
		id = "df3b8896-7229-5b3b-ad2f-774b0cea167c"
	strings:
		$s2 = "Moziea/4.0" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_I
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
		$s1 = "(Prxy%c-%s:%u)" fullword ascii
		$s2 = "Google Inc." fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_I {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "fe211c7a081c1dac46e3935f7c614549"
		hash2 = "8c9db773d387bf9b3f2b6a532e4c937c"
		id = "55046e1a-731a-5418-9a7a-4fe1611c77d0"
	strings:
		$s0 = "Copyright 2012 Google Inc. All rights reserved." fullword wide
		$s1 = "(Prxy%c-%s:%u)" fullword ascii
		$s2 = "Google Inc." fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_9
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\Windo" ascii
		$s2 = "oHHOSTR" ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" ascii
		$s6 = "Ora\\%^" ascii
		$s7 = "\\Ohttp=r" ascii
		$s17 = "help32Snapshot0L" ascii
		$s18 = "TimUmoveH" ascii
		$s20 = "WideChc[lobalAl" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_9 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "442bf8690401a2087a340ce4a48151c39101652f"
		id = "bf24bb57-aff9-579c-b8a2-265a6d2a06d0"
	strings:
		$s0 = "\\Windo" ascii
		$s2 = "oHHOSTR" ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" ascii
		$s6 = "Ora\\%^" ascii
		$s7 = "\\Ohttp=r" ascii
		$s17 = "help32Snapshot0L" ascii
		$s18 = "TimUmoveH" ascii
		$s20 = "WideChc[lobalAl" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_10
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s3 = "!! Use Connect Method !!" fullword ascii
		$s4 = "(Prxy%c-%s:%u)" fullword ascii
		$s5 = "msmsgs" fullword wide
		$s18 = "(Prxy-No)" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_10 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "eb518cda3c4f4e6938aaaee07f1f7db8ee91c901"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "Version 4.7.3001" fullword wide
		$s1 = "Copyright (c) Microsoft Corporation 2004" fullword wide
		$s2 = "Microsoft(R) is a registered trademark of Microsoft Corporation in the U" wide
		$s3 = "!! Use Connect Method !!" fullword ascii
		$s4 = "(Prxy%c-%s:%u)" fullword ascii
		$s5 = "msmsgs" fullword wide
		$s18 = "(Prxy-No)" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_11
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
		$s1 = "msofscan.exe" fullword wide
		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
		$s9 = "NetEagle_Scout - " fullword ascii
		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
		$s11 = "Windows 3.1(Win32s)" fullword ascii
		$s12 = "%s%s%s %s" fullword ascii
		$s13 = "Server 4.0" fullword ascii
		$s15 = "Windows Millennium Edition" fullword ascii
		$s16 = "msofscan" fullword wide
		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
		$s18 = "Workstation 4.0" fullword ascii
		$s19 = "2003 Microsoft Office system" fullword wide

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_11 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "59066d5d1ee3ad918111ed6fcaf8513537ff49a6"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "System\\CurrentControlSet\\control\\ComputerName\\ComputerName" fullword ascii
		$s1 = "msofscan.exe" fullword wide
		$s2 = "Mozilla/4.0 (compatible; MSIE 5.0; Win32)" fullword ascii
		$s3 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s4 = "Windows XP Professional x64 Edition or Windows Server 2003" fullword ascii
		$s9 = "NetEagle_Scout - " fullword ascii
		$s10 = "Server 4.0, Enterprise Edition" fullword ascii
		$s11 = "Windows 3.1(Win32s)" fullword ascii
		$s12 = "%s%s%s %s" fullword ascii
		$s13 = "Server 4.0" fullword ascii
		$s15 = "Windows Millennium Edition" fullword ascii
		$s16 = "msofscan" fullword wide
		$s17 = "Eagle-Norton360-OfficeScan" fullword ascii
		$s18 = "Workstation 4.0" fullword ascii
		$s19 = "2003 Microsoft Office system" fullword wide
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_12
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "Richic" fullword ascii
		$s1 = "Accept: image/gif, */*" fullword ascii
		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii

Detection condition:
filesize < 250KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_12 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b02b5720ff0f73f01eb2ba029a58b645c987c4bc"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "Richic" fullword ascii
		$s1 = "Accept: image/gif, */*" fullword ascii
		$s2 = "----------------g_nAV=%d,hWnd:0x%X,className:%s,Title:%s,(%d,%d,%d,%d),BOOL=%d" fullword ascii
	condition:
		filesize < 250KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_13
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "msofscan.exe" fullword wide
		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
		$s4 = "msofscan" fullword wide
		$s6 = "2003 Microsoft Office system" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_13 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "a359f705a833c4a4254443b87645fd579aa94bcf"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "msofscan.exe" fullword wide
		$s1 = "Microsoft? is a registered trademark of Microsoft Corporation." fullword wide
		$s2 = "Microsoft Office Word Plugin Scan" fullword wide
		$s3 = "? 2006 Microsoft Corporation.  All rights reserved." fullword wide
		$s4 = "msofscan" fullword wide
		$s6 = "2003 Microsoft Office system" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_14
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "AdobeReader.exe" fullword wide
		$s4 = "10.1.7.27" fullword wide
		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
		$s8 = "Adobe Reader" fullword wide

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_14 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "b0740175d20eab79a5d62cdbe0ee1a89212a8472"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "AdobeReader.exe" fullword wide
		$s4 = "10.1.7.27" fullword wide
		$s5 = "Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All ri" wide
		$s8 = "Adobe Reader" fullword wide
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_15
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\Windo" ascii
		$s2 = "HHOSTR"  ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" fullword ascii
		$s17 = "help32Snapshot0L" fullword ascii
		$s18 = "TimUmoveH" ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_15 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "7a8576804a2bbe4e5d05d1718f90b6a4332df027"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "\\Windo" ascii
		$s2 = "HHOSTR"  ascii
		$s3 = "Softwa]\\Mic" ascii
		$s4 = "Startup'T" fullword ascii
		$s17 = "help32Snapshot0L" fullword ascii
		$s18 = "TimUmoveH" ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_16
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s0 = "\\Temp1020.txt" ascii
		$s1 = "cmcbqyjs" fullword ascii
		$s2 = "SPVSWh\\" fullword ascii
		$s4 = "PSShxw@" fullword ascii
		$s5 = "VWhHw@" fullword ascii
		$s7 = "SVWhHw@" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_16 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "066d06ac08b48d3382d46bbeda6ad411b6d6130e"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s0 = "\\Temp1020.txt" ascii
		$s1 = "cmcbqyjs" fullword ascii
		$s2 = "SPVSWh\\" fullword ascii
		$s4 = "PSShxw@" fullword ascii
		$s5 = "VWhHw@" fullword ascii
		$s7 = "SVWhHw@" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Generic_A
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s5 = "WPVWhhiA" fullword ascii
		$s6 = "VPWVhhiA" fullword ascii
		$s11 = "VPhhiA" fullword ascii
		$s12 = "uUhXiA" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Generic_A {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash1 = "9f49aa1090fa478b9857e15695be4a89f8f3e594"
		hash2 = "396116cfb51cee[PII_REDACTED]42f6ccf81856c2fb"
		hash3 = "fef9c3b4b35c226501f7d60816bb00331a904d5b"
		hash4 = "7c9a13f1fdd6452fb6d62067f958bfc5fec1d24e"
		hash5 = "5257ba027abe3a2cf397bfcae87b13ab9c1e9019"
		id = "6b851d94-d3bd-5c76-8fd0-adb42b3fab73"
	strings:
		$s5 = "WPVWhhiA" fullword ascii
		$s6 = "VPWVhhiA" fullword ascii
		$s11 = "VPhhiA" fullword ascii
		$s12 = "uUhXiA" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}
YARA Detection Rule: APT30_Sample_17
Repository: Neo23x0/signature-base
Detects: FireEye APT30 Report Sample
Author: Florian Roth (Nextron Systems)
Reference: https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf

Pattern signatures:
$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
		$s4 = "IEXPL0RE" fullword ascii

Detection condition:
filesize < 100KB and uint16(0) == 0x5A4D and all of them

Full rule:
rule APT30_Sample_17 {
	meta:
		description = "FireEye APT30 Report Sample"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		author = "Florian Roth (Nextron Systems)"
		reference = "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf"
		date = "2015/04/13"
		hash = "c3aa52ff1d19e8fc6704777caf7c5bd120056845"
		id = "e5dd6bc9-9383-5d48-92df[PII_REDACTED]55"
	strings:
		$s1 = "Nkfvtyvn}]ty}ztU" fullword ascii
		$s4 = "IEXPL0RE" fullword ascii
	condition:
		filesize < 100KB and uint16(0) == 0x5A4D and all of them
}