2019-11-07-malscript_excel_shellcodeloader_1-vk.yar

rule malscript_excel_shellcodeloader_1 
{
   meta:
      description = "Detects this DW-userprofile.hta Excel loading shellcode script"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/1192510991566868483"
      date = "2019-11-07"
      hash1 = "44beab3903c096e695a9ca1c2a6ee54ec10f44c3916bbb70fa016494e628039b"
   
   strings:
      $str0 = "ExecuteExcel4Macro('CALL(\"Kernel32\",\"CreateThread\",\"JJJJJJJ\",0, 0, '" fullword ascii
      $str1 = "ExecuteExcel4Macro('CALL(\"Kernel32\",\"VirtualAlloc\",\"JJJJJ\",0,' " fullword ascii
      $str2 = "ExecuteExcel4Macro('CALL(\"Kernel32\",\"WriteProcessMemory\",\"JJJCJJ\",-1, ' + " ascii
      $str3 = "new ActiveXObject(\"Excel.Application\")" ascii
      $char0 = "CHAR(" ascii
   
   condition:
      (
         filesize < 100KB and
         ( 3 of ($str*) and #char0 > 100)
      )
}