privateloader.yar

rule PrivateLoader_ExportParsing
{
	meta:
		author = "Karsten Hahn"
		description = "PrivateLoader export parsing"
		sha256 = "892834734712fe5bc7a6614be6972de1be2d74ad424ef47b2c701046e4912426"

	strings:
		$code = {
			b8 4d 5a 00 00               // MOV  EAX,0x5a4d
			66 39 ??                     // CMP  word ptr [param_2],AX
			(0f 85 ?? ?? ?? ?? | 0f 85 ) // JNZ  LAB_0040180b --> the jump addresses are cut out in some samples
			8b ?? 3c                     // MOV  EAX,dword ptr [param_2 + 0x3c]
			03 ??                        // ADD  peheader,param_2
			81 38 50 45 00 00            // CMP  dword ptr [peheader->Signature],0x4550
			(0f 85 ?? ?? ?? ?? | 0f 85 ) // JNZ  LAB_0040180b --> the jump addresses are cut out in some samples
			b9 0b 02 00 00               // MOV  dllbase,0x20b
			66 39 48 18                  // CMP  word ptr [EAX + peheader->OptionalHeader.Magic],dll
			75 ??                        // JNZ  LAB_0040145a
			8b 88 8c 00 00 00            // MOV  dllbase,dword ptr [EAX + peheader+0x8c]
			8b 80 88 00 00 00            // MOV  peheader,dword ptr [EAX + peheader+0x88]
			eb ??                        // JMP  LAB_00401460  
			8b 48 7c                     // MOV  dllbase,dword ptr [EAX + peheader+0x7c]
			8b 40 78                     // MOV  peheader,dword ptr [EAX + peheader+0x78]
		}
		
	condition:
		$code
}