From b19ae99c0b2e27184cb74c62cd9afe2e00166e49 Mon Sep 17 00:00:00 2001
From: mmorenog <mmorenog@users.noreply.github.com>
Date: Thu, 21 Jul 2016 14:46:21 +0200
Subject: [PATCH] Create JJencode.yar

---
 Packers/JJencode.yar | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 Packers/JJencode.yar

diff --git a/Packers/JJencode.yar b/Packers/JJencode.yar
new file mode 100644
index 0000000..7f0c348
--- /dev/null
+++ b/Packers/JJencode.yar
@@ -0,0 +1,19 @@
+/*
+    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.
+
+*/
+rule jjEncode
+{
+   meta:
+      description = "jjencode detection"
+      ref = "http://blog.xanda.org/2015/06/10/yara-rule-for-jjencode/"
+      author = "adnan.shukor@gmail.com"
+      date = "10-June-2015"
+      version = "1"
+      impact = 3
+      hide = false
+   strings:
+      $jjencode = /(\$|[\S]+)=~\[\]\;(\$|[\S]+)\=\{[\_]{3}\:[\+]{2}(\$|[\S]+)\,[\$]{4}\:\(\!\[\]\+["]{2}\)[\S]+/ fullword 
+   condition:
+      $jjencode
+}