hello@dissectingmalwa.re

m3do2.exe

advapi32.dll

mpr.dll

shlwapi.dll

0c4a84b66832a08dccc42b478d9d5e1b

bec9b3480934ce3d30c25e1272f60d02

51a8b4c9f41b0c0ca57db63e21505b0d

26a02a149aca6a8a43e2dca5c75a6360cfe54c50

f611c2976ebb080214eddd905d30628230f2280d

2c940a35025dd3847f7c954a282f65e9c2312d2ada28686f9d1dc73d1c500224

ebfdee6e5fe2aa5699280248a5e7b714ca18e5bfd284cac0ba4fb88ccbcec5b6

import "pe"

rule upx_packer_modified_pandora : Packer {
	meta:
		author = "Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>"
		description = "Detects modified UPX packer used by Pandora Ransomware"
		reference = "https://dissectingmalwa.re/blog/pandora/"
		date = "2022-03-16"
		tlp = "WHITE"
		hash = "5b56c5d86347e164c6e571c86dbf5b1535eae6b979fede6ed66b01e79ea33b7b"
	strings:
		$header = { 33 2E 30 30 00 55 50 58 21 }
	condition:
		uint16(0) == 0x5a4d and pe.imphash() == "51a8b4c9f41b0c0ca57db63e21505b0d" and $header and for any i in (0 .. pe.number_of_sections) : ( pe.sections[i].name == "pppp" and pe.sections[i + 1].name == "cccc" ) and filesize > 112KB and filesize < 1MB
}