[Community-sigs] Win.Trojan.Downloader

[Mariano Graziano]

Askar,
initially the signature didn't pass the FP test.
I modified it in the following way:

Win.Trojan.Downloader;Target:1;0&(1>2)&(2>70)&(3>100)&(4>5);28900:85C0744785D2743653565789C689D78B4FFC578B56FC4A7820668B0683C60229D17E16F266AF751189CB565789D1F366A75F5E740C89D9EBEA5A31C0EB0A31C0C35A89F829D0D1E85F5E5BC3;440065006c00700068006900;53656e646572;437265617465;42797465496e646578

In this way there are no more FPs. I chose some peculiar strings and their
number of occurrences.
The new and updated signature will be published soon.

Thank you.

On Tue, Aug 2, 2016 at 7:33 PM, Christopher McBee (chmcbee) <
chmcbee at cisco.com> wrote:

> Askar,
> thanks very much for your submission.  Your signature has been added to FP
> testing.
>
> Thanks,
> Christopher
>
> > On Jul 31, 2016, at 9:20 AM, Askar Dyussekeyev <dyussekeyev at yandex.kz>
> wrote:
> >
> >
> Win.Trojan.Downloader:1:9963:8D4DDCE8DE610000A1842A45008945F08945E88D45EC8D4DDC50C645FC07E8EF6100008D45EC68A4224500508D45E450C645FC08E87F450200508D4DE8C645FC09E8164402008D4DE4C645FC08E8D142020068702245008D4DF0E84D4402008D45E88BCE508D45F050E820FBFFFF8D45EC6864224500508D45E450E838450200508D4DE8C645FC0AE8CF4302008D4DE4C645FC08E88A42020068302245008D4DF0E8064402008D45E88BCE508D45F050E8D9FAFFFF8D45EC6824224500508D45E450E8F1440200508D4DE8C645FC0BE8884302008D4DE4C645FC08E84342020068EC2145008D4DF0E8BF4302008D45E8508D45F0508BCEE892FAFFFFFFD384C07554
> >
> > signature looks for specific block of code
> >
> > detections (175):
> > 029e119c10590b793f1f3fc063824073
> > 09c65f0cd716eff4decc617ce960792f
> > 0a474bb52e01c0c8ccec993332905a51
> > ................................
> > fe547cf7f560e5b5723c0f47b723c1b6
> > fe86e7d6c2c71c38efe5711911ab0138
> > feacbdfc339fc333327161301f9dbd25
> > _______________________________________________
> > Community-sigs mailing list
> > Community-sigs at lists.clamav.net
> > http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
> >
> > http://www.clamav.net/contact.html#ml
>
> _______________________________________________
> Community-sigs mailing list
> Community-sigs at lists.clamav.net
> http://lists.clamav.net/cgi-bin/mailman/listinfo/community-sigs
>
> http://www.clamav.net/contact.html#ml
>