I'm looking to write a yara signature based on an interesting decoding algorithm in a family of malware, but I'm having difficulty with correlating addresses with imported functions.

Specifically, I want to write a yara signature that is aware of what functions the PE has imported, and where they are located.

I want to write a functions that follows the jumps in the below disassembly (which I know how to do), and which validates that the code blocks are correct by checking the addresses for the calls correlate with the correct imported functions, but I don't know how to parse the PE structure to do that. As an example, the highlighted code correlates with 0xff15824c0000, but I don't know how to check that that address correlates with an imported LdrFindResource_U. Is this even possible to do in Yara?

enter image description here

To clarify, an individual code block would be a hex string with a handful of ??s to support arbitrary offsets, and the condition would validate that the offset specified by the jump correlates with another capture group for the next block. Then, the condition would validate that the offset containing the call maps to the import of the correct imported function based on the PE structure. I just don't have an idea of how to do that last part without assistance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.