sysopfb

rule sc_in_jquery
{
strings:
$a = {5? 8b [1-3] 83 ?? 04 8b [1-2] 31 [1-2] 83 ?? 04 5? 8b [1-2] 31 ?? 8?}
$b = "jquery.org/license" nocase
condition:
all of them
}

sysopfb

"""
Based on: https://gist.github.com/lbenedix/8275d01c2289a7a20d2c6c27ee8ae68e

Moved an if block and added a double empty string check for input validation

"""

def sift4_simple(s1, s2, max_offset=5):
    """

sysopfb

# Python2 just because
# Samples:  
# 22d7d67c3af10b1a37f277ebabe2d1eb4fd25afbd6437d4377400e148bcc08d6
# c6e2ef30a86baa670590bd21acf5b91822117e0cbe6060060bc5fe0182dace99


import pefile
import struct
import sys

sysopfb

import idc
import idautils
import idaapi
import ida_bytes
import ida_funcs
import ida_search
import ida_segment
import Utils

info = idaapi.get_inf_structure()

sysopfb

import sys
import struct

magic = '\xfa\xff\xff\xff\x00\x00'

ver = 'le'
psize = 8

def find_pclntab(data):
    off = data.find(magic)

sysopfb

import dns.resolver

c = '.stage.1950252.updates.updaternetworkmanagerr.com'
v = ord('a')
vv = ord('a')
vvv = ord('a')
done = False
out = ""
while not done:
    t = dns.resolver.query(chr(v)+chr(vv)+chr(vvv)+c, 'TXT')

sysopfb

DGA code:

import java.util.Calendar;
import java.util.Random;
public class myTest {
    private static long seed;
    private static final int MAX_HOSTS = 2000;
private static void GetSeed(int m) {
        int i = Calendar.getInstance().get(1);

sysopfb

The Lambo - eCrime correlation effect

Compiled by Jason Reaves

Lamborghini sales

YEAR	Sales	Growth
1997	48

sysopfb

import sys
import pefile
import struct

def decode(data):
	out = ""
	for i in range(len(data)/2):
		t1 = data[i*2]
		t2 = data[(i*2)+1]
		t1 &= 0xf0

sysopfb

def decode_data(data, key, sz): 
    S = list(range(sz)) 
    S = [x&0xff for x in S] 
    j = 0 
    out = []
    for i in range(sz): 
        j = (j + S[i] + ord( key[i % len(key)] )) % sz 
        S[i] , S[j] = S[j] , S[i]
    i = j = 0 
    for char in data: