From c7305795225a434128894bfb535dad8c1e09e7c8 Mon Sep 17 00:00:00 2001 From: keaton-sublime Date: Tue, 7 Jul 2026 17:14:35 -0400 Subject: [PATCH 1/2] Update generic_pdf.yar --- yara/generic_pdf.yar | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/yara/generic_pdf.yar b/yara/generic_pdf.yar index 5891ac5fdba..c7066915510 100644 --- a/yara/generic_pdf.yar +++ b/yara/generic_pdf.yar @@ -497,3 +497,28 @@ rule w9inv_2page_image { condition: $header and (any of ($w9_img*) or any of ($inv_img*)) } + +rule pdf_js_function_box_lure { + meta: + author = "kyle eaton" + date = "2026-07-07" + description = "matching PDF with box shaped lure and embedded javascript - s/o greg" + strings: + $header = { 25 50 44 46 2D 31 2E } + $js1 = { 2E 72 65 70 6C 61 63 65 28 2F 5C 5C 78 2F 67 2C 20 22 25 22 29 } + $js2 = { 2F 4A 61 76 61 53 63 72 69 70 74 0A 2F 4A 53 20 28 76 61 72 20 } + condition: + $header at 0 and $js1 and $js2 +} + +rule pdf_rect_size_box_lure { + meta: + author = "kyle eaton" + date = "2026-07-07" + description = "matching rect sizes for PDFs with box shaped lure and embedded javascript - s/o greg" + strings: + $header = { 25 50 44 46 2D 31 2E } + $rect_size = { 2f 52 65 63 74 20 5b 32 38 30 20 33 34 30 20 34 32 30 20 33 37 32 5d } + condition: + $header at 0 and $rect_size +} From e629dc977ead6731939422111c1b059420f35518 Mon Sep 17 00:00:00 2001 From: keaton-sublime Date: Tue, 7 Jul 2026 17:20:42 -0400 Subject: [PATCH 2/2] Update generic_pdf.yar --- yara/generic_pdf.yar | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yara/generic_pdf.yar b/yara/generic_pdf.yar index c7066915510..b8e897ac84d 100644 --- a/yara/generic_pdf.yar +++ b/yara/generic_pdf.yar @@ -502,7 +502,7 @@ rule pdf_js_function_box_lure { meta: author = "kyle eaton" date = "2026-07-07" - description = "matching PDF with box shaped lure and embedded javascript - s/o greg" + description = "matching javascript for PDFs with box shaped lure and embedded javascript - s/o greg" strings: $header = { 25 50 44 46 2D 31 2E } $js1 = { 2E 72 65 70 6C 61 63 65 28 2F 5C 5C 78 2F 67 2C 20 22 25 22 29 }