rule ARKBIRD_SOLG_TA505_Maldoc_21Nov_2 : FILE
{
meta:
description = "invitation (1).xls"
...
hash1 = "270b398b697f10b66828afe8d4f6489a8de48b04a52a029572412ae4d20ff89b"

strings:
$x1 = "C:\\Users\\J\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\AFFA0BDC.tmp" fullword wide
$x2 = "C:\\Users\\J\\AppData\\Local\\Temp\\AFFA0BDC.tmp" fullword wide
$x3 = "C:\\Windows\\system32\\FM20.DLL" fullword ascii
$x4 = "C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd" fullword ascii
$x5 = "C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL" fullword ascii
$x6 = "C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL" fullword ascii
$x7 = "*\\G{0D452EE1-E08F-101A-852E-02608C4D0BB4}#2.0#0#C:\\Windows\\system32\\FM20.DLL#Microsoft Forms 2.0 Object Library" fullword wide
$x8 = "*\\G{BA45F137-16B2-487D-9A21-F38179C0576C}#2.0#0#C:\\Users\\J\\AppData\\Local\\Temp\\VBE\\MSForms.exd#Microsoft Forms 2.0 Object" wide
$s9 = "*\\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.8#0#C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE16\\MSO.DLL#Microsoft " wide
$s10 = "lIySgefa86jIfdEkSZVDoSs5BDkcalCieNBN4EqfVaEs2wWD4OjpTiOBqDrL3d9WCaDAKZpoJPRnoacfQPhucmy69axznNmRbRY12v3ez5PdAAnpAl5m5NUqKHBKCYb5" ascii
$s11 = "35mvkZ9ZvIttuHSTUKWZCdOsh5j4Y1p2pJ3vi5onOXnMcEPIUIK1UWAYq3noPeaDtAdUOxKYvIlNZbqMpJjqpxhCidfpQ9GJXStKA44w7UFlKV9oMK8f5Tn6tKMKsviw" ascii
$s12 = "*\\G{000204EF-0000-0000-C000-000000000046}#4.2#9#C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7.1\\VBE7.DLL#Visual" wide
$s13 = "verkar.dll" fullword ascii
$s14 = "intc.dll" fullword ascii
$s15 = "YjAygups4wPzNU7lNIGBuFbv6Triw8rxEPLSjrYSKXdUV8QuzbwJvdHshfBvdh66er47iobvTX1FCqI8d6RuKRcBhsLdYCOC1hPEdTllabYHlcZ1FDsgyLuwoCZYM7Fq" ascii
$s16 = "MinuetsOs.dll" fullword wide
$s17 = "KaBYL8xLRpN7VMzibXEzxh2GetwfB6MY9k3dRCNncC5eiyKNTaTrcoUDi4TrLrkULX7KSvAHjrw4lXxPRSvBmvWUzz5WRwKTskBtBa4xIlhT1ZruGeI36SIqamksANYW" ascii
$s18 = "XmhvJDfd16Hxk6eRMKJ7sqYIVneFVN7iUzRF8or7LKNKW9bhf5a7V5OGwIIvyJrm8yMUoITytLvRMoVWm7z1NawYTkjzP5HbtBLxwp3GkLMjJ74iWVjBjzI8cWadyuRy" ascii
$s19 = "Sx3mdokmfv27AYhtFublOb5Exec1r1b5LAAbsRHrjLKTWiG4K9dKXbuQBxY9mt4nu7u9ygaWWTcczlRpGhpsXzgKgTI52IfZRxyZWHFD8pXd9sqqOJBedLy4ZT3OHe5n" ascii
$s20 = "C:\\Windows\\system32\\stdole2.tlb" fullword ascii

condition:
uint16( 0 ) == 0xcfd0 and filesize < 5000KB and 1 of ( $x* ) and 4 of them
}

// This function is older than me and probably pays taxes
// TODO: Ask if this while loop has health insurance
// Here lies Sarah's hopes and dreams (2019-2022), killed by this recursive call

// yo why this token validation looking kinda thicc though
// fr fr no cap this base64 decode bussin
// wait... hold up... this ain't bussin at all