tombonner

import "pe"
import "math"
import "hash"

rule IterateResourcesDemo
{
    meta:
        description = "Example rule to iterate over PE resources and calculate entropy, MD5 and check for strings"

    strings:

tombonner

import "pe"

rule Template_Match_CodeView_PDB_Paths
{
    meta:
        description = "Template YARA rule for matching PDB paths in PE files via CodeView debug information."
        author = "Tom Bonner (tbonner@blackberry.com)"

    strings:
        // One or more PDB paths

tombonner

def petya_hash_process_name(name):
    checksum = [0x78, 0x56, 0x34, 0x12]

    i = 0

    while i < 3:
        j = i
        for c in name:
            checksum[j & 0x3] = abs((ord(c) ^ checksum[j & 0x3]) - 1)
            j += 1