vee1e/capa-rules
1
0
Fork 0
mirror of https://github.com/vee1e/capa-rules.git synced 2026-09-02 03:17:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Create execute-vbscript-javascript-or-jscript-in-memory.yml

Browse source
This commit is contained in:
Blas 2023-02-06 13:31:07 -05:00 • committed by GitHub
parent ffe68a3051
commit 06c3803bdd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
load-code/execute-vbscript-javascript-or-jscript-in-memory.yml Normal file
View file

@ -0,0 +1,20 @@
# generated using capa explorer for IDA Pro
rule:
meta:
name: execute VBScript Javascript or JScript in memory
namespace: load-code
authors:
- blas.kojusner@mandiant.com
description: the sample may execute 32-bit VBScript, JavaScript, or JScript (32-bit)
scope: function
references:
- https://gist.github.com/odzhan/d18145b9538a3653be2f9a580b53b063
examples:
- 65B1EA6E5254D458C602504CEEDA5E05:0x401160
features:
- and:
- api: CoCreateInstance
- bytes: E1 2A 1A BB F9 A4 CF 11 8F 20 00 80 5F 2C D0 64 = IID_IActiveScript
- bytes: E2 2A 1A BB F9 A4 CF 11 8F 20 00 80 5F 2C D0 64 = IID_IActiveScriptParse32
- operand[0].number: 0x2 = SCRIPTSTATE_CONNECTED
- operand[1].offset: 0x14 = ParseScriptText