mirror of
https://github.com/roadwy/DefenderYara
synced 2026-06-21 14:08:27 +00:00
roadwy
1341 lines
69 KiB
Plaintext
1341 lines
69 KiB
Plaintext
|
|
rule _#Exploit_Java_PrevalentPattern{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 35 42 43 33 41 42 42 35 39 42 37 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 153615BC3ABB59B73A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_2{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 32 34 43 42 42 35 39 32 41 42 37 42 36 42 36 34 42 32 41 32 42 31 32 42 36 34 42 32 41 42 38 42 30 } //1 124CBB592AB7B6B64B2A2B12B64B2AB8B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_3{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 30 33 33 32 42 36 42 36 42 38 42 38 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536190332B6B6B8B83A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_4{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 32 44 32 43 42 38 32 41 42 36 32 44 32 43 42 38 41 37 } //1 1904321903322AB62D2CB82AB62D2CB8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_5{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 42 36 31 39 42 36 42 38 42 42 35 39 42 37 31 32 42 38 42 36 31 32 42 36 42 36 42 36 35 37 41 37 } //1 19B619B6B8BB59B712B8B612B6B6B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_6{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 } //1 5911105459111054591110545911105459
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_7{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 31 39 42 36 32 44 31 43 33 32 42 38 30 34 36 30 39 32 42 36 42 36 33 41 38 34 41 37 } //1 BB59B719B62D1C32B8046092B6B63A84A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_8{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 42 36 31 39 30 37 33 32 30 33 42 44 42 36 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 153619B619073203BDB63A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_9{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 42 36 31 39 30 37 33 32 30 33 42 44 42 36 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 153619B619073203BDB63A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_10{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 32 44 42 42 35 39 31 39 42 37 42 36 33 41 42 38 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 15362DBB5919B7B63AB83A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_11{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 32 44 42 42 35 39 31 39 42 37 42 36 33 41 42 38 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 15362DBB5919B7B63AB83A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_12{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 32 42 42 35 32 41 42 37 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 32 43 42 35 42 31 } //1 2A2BB52AB72A12B52A12B52A12B52A2CB5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_13{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 43 31 44 32 42 30 35 31 44 36 38 30 35 31 44 36 38 30 35 36 30 42 36 31 30 42 38 39 31 35 34 38 34 41 37 } //1 2C1D2B051D68051D680560B610B8915484A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_14{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 42 36 35 46 42 36 35 42 35 37 42 36 35 46 42 36 42 36 35 41 42 36 35 46 36 34 35 41 33 45 34 44 33 36 } //1 59B65FB65B57B65FB6B65AB65F645A3E4D36
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_15{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 32 31 35 42 32 31 35 33 33 42 32 38 32 42 32 36 34 39 31 35 34 42 32 30 34 36 30 42 33 38 34 31 35 41 37 } //1 B215B21533B282B2649154B20460B38415A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_16{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 32 41 42 36 42 43 30 34 35 39 35 38 31 30 35 46 35 39 42 45 30 34 36 34 35 42 33 45 34 43 33 44 } //1 BB592AB6BC045958105F59BE04645B3E4C3D
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_17{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 32 42 32 41 42 36 33 41 31 31 33 36 31 35 31 31 36 38 33 36 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 15362B2AB63A113615116836123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_18{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 44 42 38 33 41 32 41 32 42 31 39 30 33 31 39 42 45 42 38 42 36 35 37 32 41 32 42 30 34 42 36 33 41 31 39 42 30 } //1 2DB83A2A2B190319BEB8B6572A2B04B63A19B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_19{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 } //1 59B719B612B6B63ABB59B719B612B6B63ABB59
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_20{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 31 42 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 42 46 } //1 01B00000000000000000000000000000000000BF
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_21{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 34 42 44 34 43 32 42 30 33 32 41 35 33 42 42 35 39 31 33 42 38 32 42 42 37 34 44 32 43 42 36 32 43 42 36 43 30 42 30 } //1 04BD4C2B032A53BB5913B82BB74D2CB62CB6C0B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_22{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 34 42 44 34 44 32 43 30 33 32 42 35 33 42 42 35 39 31 33 31 32 32 43 42 37 34 45 32 44 42 36 32 44 42 36 43 30 42 30 } //1 04BD4D2C032B53BB5913122CB74E2DB62DB6C0B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_23{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 30 31 35 42 38 42 38 33 36 31 39 42 38 31 34 31 35 38 37 42 38 36 42 42 38 31 30 42 38 42 36 35 37 38 34 31 35 41 37 } //1 1015B8B83619B8141587B86BB810B8B6578415A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_24{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 30 33 33 32 42 38 42 36 30 33 33 32 30 33 42 44 42 36 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536190332B8B6033203BDB63A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_25{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 30 33 33 32 42 38 42 36 30 33 33 32 30 33 42 44 42 36 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 1536190332B8B6033203BDB63A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_26{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 31 39 31 39 42 38 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 15361904321903322AB61919B8123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_27{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 31 39 31 39 42 38 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 15361904321903322AB61919B8133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_28{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 31 39 31 39 42 36 30 34 36 34 33 32 42 36 31 32 42 36 42 36 33 41 31 39 42 38 33 41 31 39 42 36 41 37 } //1 BB59B71919B6046432B612B6B63A19B83A19B6A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_29{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 42 37 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 42 31 } //1 2AB72A12B52A12B52A12B52A12B52A12B52A12B5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_30{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 44 32 41 31 44 42 36 31 43 38 32 39 32 35 46 35 41 31 43 38 32 39 32 31 30 37 45 39 32 33 44 35 35 38 34 31 44 39 42 } //1 2B1D2A1DB61C82925F5A1C8292107E923D55841D9B
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_31{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 44 32 41 31 44 42 36 31 43 38 32 39 32 35 46 35 41 31 43 38 32 39 32 31 30 37 45 39 32 33 44 35 35 38 34 31 44 41 37 } //1 2B1D2A1DB61C82925F5A1C8292107E923D55841DA7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_32{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 } //1 591110545911105459111054591110545911105459
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_33{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 32 43 31 39 42 36 30 34 36 34 33 32 42 36 31 32 42 38 42 36 42 36 33 41 31 39 42 38 33 41 31 39 42 36 41 37 } //1 BB59B72C19B6046432B612B8B6B63A19B83A19B6A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_34{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 32 41 30 35 42 44 35 39 30 33 32 42 35 33 35 39 30 34 32 43 35 33 42 36 35 37 42 31 } //1 03135359041353B62A05BD59032B5359042C53B657B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_35{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 43 30 35 36 43 32 41 31 43 42 36 31 30 42 38 30 37 37 38 32 41 31 43 30 34 36 30 42 36 31 30 42 38 36 30 39 31 35 34 38 34 } //1 2B1C056C2A1CB610B807782A1C0460B610B860915484
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_36{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 32 42 38 42 32 30 34 42 44 35 39 30 33 42 32 42 38 42 38 35 33 42 36 32 41 42 38 30 34 42 44 35 39 30 33 32 42 35 33 42 36 42 30 } //1 B2B8B204BD5903B2B8B853B62AB804BD59032B53B6B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_37{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 32 42 38 42 42 35 39 42 32 42 38 42 37 42 32 42 36 42 36 30 34 42 44 35 39 30 33 42 32 42 38 42 38 35 33 42 36 32 41 42 38 30 34 } //1 B2B8BB59B2B8B7B2B6B604BD5903B2B8B853B62AB804
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_38{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 31 32 31 32 31 32 31 32 31 32 31 32 42 36 42 36 42 36 42 36 42 36 42 38 42 36 42 38 42 36 32 41 42 36 42 36 42 30 } //1 BB59B7121212121212B6B6B6B6B6B8B6B8B62AB6B6B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_39{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 42 36 31 39 31 30 33 32 30 34 42 44 35 39 30 33 31 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4B619103204BD59031353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_40{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 31 33 36 31 39 30 33 33 32 42 36 42 36 42 38 42 38 33 41 31 39 31 39 30 33 33 32 42 38 33 41 31 39 32 42 32 43 42 38 31 35 31 30 41 30 } //1 1136190332B6B6B8B83A19190332B83A192B2CB81510A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_41{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 43 30 35 36 43 32 41 31 43 30 34 36 30 42 36 31 30 42 38 30 37 37 38 32 41 31 43 42 36 31 30 42 38 36 30 39 31 35 34 38 34 41 37 } //1 2B1C056C2A1C0460B610B807782A1CB610B860915484A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_42{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 43 30 35 36 43 32 41 31 43 42 36 31 30 42 38 30 37 37 38 32 41 31 43 30 34 36 30 42 36 31 30 42 38 36 30 39 31 35 34 38 34 41 37 } //1 2B1C056C2A1CB610B807782A1C0460B610B860915484A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_43{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 37 32 43 31 35 42 36 35 41 31 35 35 41 32 41 35 46 42 36 31 35 38 32 38 32 39 32 35 35 38 32 38 32 37 45 39 32 33 36 38 34 31 35 39 43 } //1 572C15B65A155A2A5FB6158282925582827E923684159C
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_44{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 31 39 31 30 33 32 42 38 43 34 31 39 31 30 33 32 42 38 43 34 31 39 31 30 33 32 42 38 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4191032B8C4191032B8C4191032B8C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_45{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 42 37 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 32 41 31 32 42 35 31 32 34 43 31 32 34 44 42 31 } //1 2AB72A12B52A12B52A12B52A12B52A12B52A12B5124C124DB1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_46{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 } //1 59111054591110545911105459111054591110545911105459
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_47{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {38 34 31 39 30 35 42 42 35 39 42 37 31 33 42 38 42 36 31 39 31 35 33 32 42 36 31 33 42 38 42 36 32 41 42 36 42 36 35 33 42 38 31 39 42 36 35 37 41 37 } //1 841905BB59B713B8B6191532B613B8B62AB6B653B819B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_48{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 31 39 42 36 31 39 42 36 31 39 42 36 42 36 33 41 31 39 31 39 42 36 33 32 42 38 33 41 42 42 35 39 31 39 42 37 33 41 31 31 42 43 33 41 } //1 BB59B719B619B619B6B63A1919B632B83ABB5919B73A11BC3A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_49{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 31 39 30 35 42 44 35 39 30 33 31 39 31 30 33 32 35 33 35 39 30 34 31 39 35 33 42 36 43 30 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 1536191905BD59031910325359041953B6C03A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_50{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 42 36 31 39 30 38 33 32 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 153619B619083205BD5903135359041353B63A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_51{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 30 33 33 32 42 36 42 36 42 38 42 38 33 41 31 39 31 39 30 33 33 32 42 38 33 41 31 39 32 42 32 43 42 38 42 42 35 39 42 37 42 46 33 41 31 39 42 36 42 31 } //1 190332B6B6B8B83A19190332B83A192B2CB8BB59B7BF3A19B6B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_52{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 31 35 42 42 35 39 42 37 31 32 42 38 42 36 32 41 31 35 30 35 36 38 31 35 30 34 36 30 30 35 36 38 42 36 42 36 42 36 42 38 42 36 35 34 38 34 31 35 41 37 } //1 1915BB59B712B8B62A1505681504600568B6B6B6B8B6548415A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_53{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 31 39 31 39 30 35 42 44 35 39 30 33 31 39 31 30 33 32 35 33 35 39 30 34 31 39 35 33 42 36 43 30 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4191905BD59031910325359041953B6C0C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_54{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 33 42 44 42 36 43 34 43 34 30 31 30 33 42 44 42 36 43 34 43 34 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103203BDB6C4C40103BDB6C4C4B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_55{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 42 32 35 37 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 41 37 } //1 000000000000000000000000B257000000000000000000000000A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_56{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 33 33 41 31 33 33 41 31 30 42 38 33 36 31 33 42 38 42 38 33 36 31 35 30 35 36 43 33 36 31 33 42 38 42 38 42 38 31 33 42 38 42 38 35 37 42 38 32 41 42 34 43 37 } //1 133A133A10B83613B8B83615056C3613B8B8B813B8B857B82AB4C7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_57{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 31 39 30 36 42 44 35 39 30 33 31 32 35 33 35 39 30 34 30 31 35 33 35 39 30 35 30 31 35 33 42 36 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536191906BD590312535904015359050153B63A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_58{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 31 39 30 36 42 44 35 39 30 33 31 32 35 33 35 39 30 34 30 31 35 33 35 39 30 35 30 31 35 33 42 36 35 37 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536191906BD590312535904015359050153B657123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_59{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 31 39 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 30 31 35 33 35 39 30 35 30 31 35 33 42 36 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 1536191906BD590313535904015359050153B63A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_60{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 31 39 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 30 31 35 33 35 39 30 35 30 31 35 33 42 36 35 37 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 1536191906BD590313535904015359050153B657133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_61{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 42 38 42 38 42 38 30 35 42 44 35 39 30 33 42 32 35 33 35 39 30 34 31 33 35 33 42 36 32 41 31 39 42 36 35 37 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536B8B8B805BD5903B25359041353B62A19B657123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_62{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 42 38 42 38 42 38 30 35 42 44 35 39 30 33 42 32 35 33 35 39 30 34 31 33 35 33 42 36 32 41 31 39 42 36 35 37 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 1536B8B8B805BD5903B25359041353B62A19B657133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_63{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 42 31 44 31 44 30 38 36 30 42 36 42 38 33 36 32 43 42 42 35 39 31 35 31 35 36 43 39 32 42 37 42 36 42 36 35 37 31 44 30 38 36 30 33 45 31 44 32 42 42 36 41 31 } //1 2B1D1D0860B6B8362CBB5915156C92B7B6B6571D08603E1D2BB6A1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_64{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 42 36 42 38 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 32 41 30 35 42 44 35 39 30 33 32 42 35 33 35 39 30 34 32 43 35 33 42 36 35 37 42 31 } //1 2AB6B805BD5903135359041353B62A05BD59032B5359042C53B657B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_65{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 32 32 43 42 36 42 36 42 42 35 39 32 43 42 36 42 37 33 41 31 32 31 32 42 36 42 38 33 41 31 39 42 36 33 41 42 42 35 39 31 39 42 37 33 41 42 38 33 41 31 35 42 43 33 41 } //1 B22CB6B6BB592CB6B73A1212B6B83A19B63ABB5919B73AB83A15BC3A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_66{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 32 44 32 43 42 38 32 41 42 36 32 44 32 43 42 38 41 37 } //1 B83A19B83A190332C0C03A1904321903322AB62D2CB82AB62D2CB8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_67{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 31 34 43 42 38 32 41 42 38 42 36 34 44 42 38 32 41 42 36 42 38 34 45 42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 42 38 31 32 33 41 42 42 35 39 42 37 } //1 014CB82AB8B64DB82AB6B84EB83A19B83A190332C0C03AB8123ABB59B7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_68{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 35 42 44 33 41 31 39 30 33 32 42 35 33 31 39 30 34 32 43 35 33 42 42 35 39 32 41 31 32 42 37 31 32 31 39 42 37 33 41 31 39 42 36 31 39 42 36 43 30 32 44 31 39 42 36 42 31 } //1 05BD3A19032B5319042C53BB592A12B71219B73A19B619B6C02D19B6B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_69{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 32 41 31 32 42 36 32 41 31 32 42 36 42 36 42 42 35 39 32 41 31 32 42 36 42 37 34 43 42 42 35 39 42 37 34 44 30 38 33 45 32 42 30 33 31 44 42 36 42 38 33 36 31 31 33 36 } //1 2A2A12B62A12B6B6BB592A12B6B74CBB59B74D083E2B031DB6B8361136
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_70{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 30 33 30 31 30 31 30 31 42 37 33 41 31 39 42 42 35 39 42 37 42 36 42 42 35 39 31 39 31 32 30 31 30 31 30 31 42 37 33 41 31 39 30 31 32 44 30 31 42 36 35 37 41 37 } //1 BB5903010101B73A19BB59B7B6BB591912010101B73A19012D01B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_71{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 42 36 31 39 30 36 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 39 35 33 35 39 30 35 31 39 35 33 42 36 33 41 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 153619B619063206BD590313535904195359051953B63A123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_72{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 39 42 36 31 39 30 36 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 39 35 33 35 39 30 35 31 39 35 33 42 36 33 41 31 33 33 36 31 33 33 36 31 35 31 35 41 30 } //1 153619B619063206BD590313535904195359051953B63A133613361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_73{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 42 36 31 39 42 36 31 39 42 36 42 42 35 39 42 37 31 39 42 36 31 39 42 36 42 36 33 41 31 39 42 38 31 39 33 41 31 39 42 36 30 34 36 30 42 38 35 39 33 41 33 41 31 39 35 37 41 37 } //1 19B619B619B6BB59B719B619B6B63A19B8193A19B60460B8593A3A1957A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_74{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 32 41 42 34 42 36 32 41 42 34 42 36 32 41 42 34 42 36 32 41 42 34 42 36 42 36 30 34 42 44 35 39 30 33 32 42 35 33 42 37 34 44 32 43 42 36 32 43 42 36 43 30 42 30 } //1 BB59B72AB4B62AB4B62AB4B62AB4B6B604BD59032B53B74D2CB62CB6C0B0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_75{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 } //1 10545911105459111054591110545911105459111054591110545911105459
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_76{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 32 42 33 31 32 42 33 42 42 35 39 42 37 42 32 42 36 31 32 42 36 42 32 42 36 31 32 42 36 42 36 42 33 42 42 35 39 42 37 42 32 42 36 31 32 42 36 42 32 42 36 31 32 42 36 42 36 42 33 42 31 } //1 12B312B3BB59B7B2B612B6B2B612B6B6B3BB59B7B2B612B6B2B612B6B6B3B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_77{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 33 31 39 42 36 31 32 31 39 42 36 33 41 30 34 42 44 33 41 31 39 30 33 42 42 35 39 42 42 35 39 42 37 31 32 42 38 42 36 31 32 42 36 42 36 42 37 35 33 31 39 31 39 31 39 42 36 35 37 41 37 } //1 5319B61219B63A04BD3A1903BB59BB59B712B8B612B6B6B753191919B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_78{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 36 42 38 34 45 42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 32 44 32 43 42 38 32 41 42 36 32 44 32 43 42 38 41 37 } //1 B6B84EB83A19B83A190332C0C03A1904321903322AB62D2CB82AB62D2CB8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_79{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 34 42 44 35 39 30 33 31 33 35 33 42 36 43 34 43 34 30 31 30 34 42 44 35 39 30 33 42 32 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103204BD59031353B6C4C40104BD5903B253B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_80{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 31 44 42 38 31 30 42 38 30 37 37 38 33 36 31 35 32 41 31 44 30 34 36 30 42 38 31 30 42 38 36 30 33 36 31 35 31 30 36 34 31 31 37 30 33 36 32 42 31 44 30 35 36 43 31 35 39 31 35 34 38 34 } //1 2A1DB810B8077836152A1D0460B810B860361510641170362B1D056C15915484
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_81{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 34 45 32 41 32 44 42 38 42 38 33 41 31 39 30 33 33 32 42 36 42 36 42 38 42 38 33 41 31 39 31 39 30 33 33 32 42 38 33 41 31 39 32 42 32 43 42 38 42 42 35 39 42 37 42 46 34 45 32 44 42 36 42 31 } //1 B84E2A2DB8B83A190332B6B6B8B83A19190332B83A192B2CB8BB59B7BF4E2DB6B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_82{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 30 31 35 33 35 39 30 35 31 39 35 33 35 33 42 36 43 30 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590306BD5903C453590401535905195353B6C0C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_83{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 31 34 43 42 38 32 41 42 38 42 36 34 44 42 38 32 41 42 36 42 38 34 45 42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 42 38 33 41 42 38 33 41 31 39 42 38 42 36 33 41 31 39 30 33 33 32 } //1 014CB82AB8B64DB82AB6B84EB83A19B83A190332C0C03AB83AB83A19B8B63A190332
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_84{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 33 31 39 42 36 31 32 31 39 42 36 33 41 30 34 42 44 33 41 31 39 30 33 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 42 36 42 36 42 37 35 33 31 39 31 39 31 39 42 36 35 37 41 37 } //1 5319B61219B63A04BD3A1903BB59BB59B7121212B6B8B612B6B6B753191919B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_85{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 35 42 44 33 41 31 39 30 33 30 33 42 38 35 33 31 39 30 34 32 43 42 38 35 33 42 38 42 38 42 38 30 35 42 44 35 39 30 33 42 32 35 33 35 39 30 34 31 33 35 33 42 36 32 41 31 39 42 36 35 37 32 42 32 44 31 39 42 38 41 37 } //1 05BD3A190303B85319042CB853B8B8B805BD5903B25359041353B62A19B6572B2D19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_86{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 32 41 42 36 42 38 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 32 41 30 35 42 44 35 39 30 33 32 42 35 33 35 39 30 34 32 43 35 33 42 36 35 37 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 15362AB6B805BD5903135359041353B62A05BD59032B5359042C53B657123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_87{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 } //1 545911105459111054591110545911105459111054591110545911105459111054591110
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_88{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 33 31 39 42 36 31 32 31 39 42 36 33 41 30 34 42 44 33 41 31 39 30 33 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 31 32 31 32 42 36 42 36 42 36 42 37 35 33 31 39 31 39 31 39 42 36 35 37 41 37 } //1 5319B61219B63A04BD3A1903BB59BB59B7121212B6B8B6121212B6B6B6B753191919B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_89{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 37 42 44 35 39 30 33 43 34 35 33 35 39 30 34 43 34 35 33 35 39 30 35 31 39 31 30 33 32 35 33 35 39 30 36 43 34 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590307BD5903C4535904C4535905191032535906C45353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_90{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 33 31 39 42 36 31 32 31 39 42 36 33 41 30 34 42 44 33 41 31 32 31 32 31 32 42 36 33 41 31 39 30 33 42 42 35 39 42 42 35 39 42 37 31 39 42 38 42 36 31 32 31 32 31 32 42 36 42 36 42 36 42 37 35 33 31 39 31 39 31 39 42 36 35 37 41 37 } //1 5319B61219B63A04BD3A121212B63A1903BB59BB59B719B8B6121212B6B6B6B753191919B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_91{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 43 34 43 34 30 31 30 35 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103205BD5903135359041353B6C4C40105BD5903C45359041353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_92{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 31 39 30 33 33 32 30 34 42 44 35 39 30 33 30 31 35 33 42 36 33 41 31 39 42 36 42 38 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 42 36 31 39 30 35 42 44 35 39 30 33 32 42 35 33 35 39 30 34 32 43 35 33 42 36 35 37 41 37 } //1 1919033204BD59030153B63A19B6B805BD5903135359041353B61905BD59032B5359042C53B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_93{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 31 42 43 34 43 30 33 33 44 31 32 34 45 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 32 44 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 38 42 36 31 32 42 36 42 36 42 37 31 31 42 37 33 41 } //1 11BC4C033D124EBB59BB59BB59B712B6B62DB6B6B7B6B73ABB59BB59BB59B712B8B612B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_94{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 42 38 31 33 31 32 42 36 33 41 31 39 30 34 42 36 31 39 30 31 42 36 43 30 33 41 42 38 33 41 31 39 42 38 31 39 30 33 31 39 42 45 42 36 33 41 30 31 31 39 31 39 31 39 42 38 42 31 33 41 31 39 42 36 31 32 33 36 31 32 33 36 31 35 31 35 41 30 } //1 1536B81312B63A1904B61901B6C03AB83A19B8190319BEB63A01191919B8B13A19B6123612361515A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_95{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 31 32 32 42 30 33 32 42 42 45 32 43 42 36 33 41 31 39 42 36 35 37 31 39 31 32 30 35 42 44 35 39 30 33 31 32 35 33 35 39 30 34 31 32 35 33 42 36 33 41 31 39 30 31 30 35 42 44 35 39 30 33 32 44 35 33 35 39 30 34 31 32 35 33 42 36 35 37 42 31 } //1 2A122B032BBE2CB63A19B657191205BD5903125359041253B63A190105BD59032D5359041253B657B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_96{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 34 43 32 42 42 38 34 44 32 43 42 36 43 30 34 45 32 44 30 34 33 32 42 38 32 44 30 33 33 32 43 30 30 33 33 32 33 41 31 32 33 41 32 41 42 32 42 36 33 41 32 41 42 32 42 36 33 41 31 39 31 39 42 38 33 41 31 32 33 41 31 39 31 39 31 32 42 38 41 37 } //1 B84C2BB84D2CB6C04E2D0432B82D0332C003323A123A2AB2B63A2AB2B63A1919B83A123A191912B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_97{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 34 33 43 31 31 42 43 34 44 30 33 33 45 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 38 42 36 31 32 42 36 42 36 42 37 31 31 42 37 33 41 } //1 043C11BC4D033E123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B712B8B612B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_98{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 06BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_99{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 37 33 43 31 31 42 43 34 44 30 33 33 45 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 38 42 36 31 32 42 36 42 36 42 37 31 31 42 37 33 41 } //1 073C11BC4D033E123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B712B8B612B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_100{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 41 42 37 30 34 42 44 35 39 30 33 30 35 42 44 35 39 30 33 32 42 35 33 35 39 30 34 32 43 35 33 35 33 33 41 30 34 42 44 33 41 31 39 30 33 31 33 35 33 32 44 42 36 31 32 31 32 31 32 42 36 42 36 31 32 42 36 31 39 42 36 33 41 31 39 32 44 31 39 42 36 33 41 42 31 } //1 2AB704BD590305BD59032B5359042C53533A04BD3A190313532DB6121212B6B612B619B63A192D19B63AB1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_101{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 42 31 } //1 B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_102{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {32 44 42 36 42 38 33 41 42 42 35 39 31 32 42 37 33 41 30 33 42 44 33 41 42 42 35 39 42 37 33 41 31 39 42 42 35 39 42 37 42 36 42 42 35 39 42 42 35 39 31 39 31 39 42 37 31 39 42 37 33 41 32 41 31 32 31 39 30 33 31 39 42 45 31 39 42 36 33 41 31 39 42 36 43 30 33 41 41 37 } //1 2DB6B83ABB5912B73A03BD3ABB59B73A19BB59B7B6BB59BB591919B719B73A2A12190319BE19B63A19B6C03AA7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_103{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 43 34 35 33 42 36 43 34 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 35 39 30 35 43 34 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103206BD59031353590413535905C453B6C406BD5903C453590413535905C453B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_104{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 37 33 43 31 31 42 43 34 44 30 33 33 45 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 42 36 42 36 42 37 31 31 42 37 33 41 } //1 073C11BC4D033E123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B7121212B6B8B612B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_105{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 42 31 } //1 B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_106{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 37 33 43 31 31 42 43 34 44 30 33 33 45 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 31 32 31 32 42 36 42 36 42 36 42 37 31 31 42 37 33 41 } //1 073C11BC4D033E123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B7121212B6B8B6121212B6B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_107{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 31 33 31 32 30 34 42 44 42 37 34 45 42 42 35 39 42 37 33 41 31 39 42 42 35 39 42 37 42 36 42 42 35 39 42 42 35 39 42 42 35 39 32 42 42 37 30 33 42 44 42 37 31 39 42 37 33 41 42 42 35 39 30 34 42 44 35 39 30 33 31 39 35 33 42 37 33 41 32 41 31 33 32 43 32 44 31 39 42 37 32 44 42 36 42 31 } //1 BB59131204BDB74EBB59B73A19BB59B7B6BB59BB59BB592BB703BDB719B73ABB5904BD59031953B73A2A132C2D19B72DB6B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_108{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 35 33 43 31 31 42 43 34 44 30 33 33 45 30 33 33 36 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 31 32 31 32 42 36 42 36 42 36 42 37 31 31 42 37 33 41 } //1 053C11BC4D033E0336123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B7121212B6B8B6121212B6B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_109{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 37 33 43 31 31 42 43 34 44 30 33 33 45 30 33 33 36 31 32 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 42 36 42 36 31 39 42 36 42 36 42 37 42 36 42 37 33 41 42 42 35 39 42 42 35 39 42 42 35 39 42 37 31 32 31 32 31 32 42 36 42 38 42 36 31 32 31 32 31 32 42 36 42 36 42 36 42 37 31 31 42 37 33 41 } //1 073C11BC4D033E0336123ABB59BB59BB59B712B6B619B6B6B7B6B73ABB59BB59BB59B7121212B6B8B6121212B6B6B6B711B73A
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_110{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 32 34 43 42 42 35 39 42 37 31 32 42 36 34 44 30 31 34 45 30 31 33 41 32 41 31 32 42 36 33 41 32 43 42 42 35 39 31 32 42 37 31 39 42 36 31 32 42 36 31 32 42 36 31 32 42 36 42 36 42 39 35 37 32 41 42 42 35 39 30 34 42 44 35 39 30 33 32 43 31 32 42 39 35 33 42 37 42 35 32 41 32 41 42 34 42 36 35 37 41 37 } //1 124CBB59B712B64D014E013A2A12B63A2CBB5912B719B612B612B612B6B6B9572ABB5904BD59032C12B953B7B52A2AB4B657A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_111{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_112{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 42 31 } //1 B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_113{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 34 34 39 30 31 33 41 31 34 33 39 32 38 31 38 36 42 32 38 31 38 36 37 36 46 31 38 35 43 30 46 36 33 33 39 36 42 34 39 32 41 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 38 31 38 36 42 32 38 31 38 36 37 36 46 31 38 35 43 30 46 36 33 33 39 36 42 34 39 32 41 42 34 35 39 33 41 43 36 } //1 1449013A143928186B2818676F185C0F63396B492A00000000000000000000000028186B2818676F185C0F63396B492AB4593AC6
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_114{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 42 35 39 42 37 31 32 42 36 32 44 42 36 42 36 42 36 42 38 33 41 42 42 35 39 31 32 42 37 33 41 30 33 42 44 33 41 42 42 35 39 42 37 33 41 31 39 42 42 35 39 42 37 42 36 42 42 35 39 42 42 35 39 31 39 31 39 42 37 31 39 42 37 33 41 32 41 31 32 31 39 30 33 31 39 42 45 31 39 42 36 33 41 31 39 42 36 43 30 33 41 41 37 } //1 BB59B712B62DB6B6B6B83ABB5912B73A03BD3ABB59B73A19BB59B7B6BB59BB591919B719B73A2A12190319BE19B63A19B6C03AA7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_115{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 31 33 35 33 42 36 43 34 43 34 30 31 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103206BD590313535904135359051353B6C4C40106BD5903135359041353590504BD5903135353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_116{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 32 41 31 31 42 38 42 35 42 31 } //1 B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B52A11B8B5B1
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_117{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 30 30 30 30 30 30 30 30 30 31 34 34 39 30 31 33 41 31 34 33 39 32 38 31 38 36 42 32 38 31 38 36 37 36 46 31 38 35 43 30 46 36 33 33 39 36 42 34 39 32 41 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 32 38 31 38 36 42 32 38 31 38 36 37 36 46 31 38 35 43 30 46 36 33 33 39 36 42 34 39 32 41 42 34 35 39 33 41 43 36 } //1 00000000001449013A143928186B2818676F185C0F63396B492A00000000000000000000000028186B2818676F185C0F63396B492AB4593AC6
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_118{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 37 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 39 35 33 35 39 30 35 31 39 31 30 33 32 35 33 35 39 30 36 43 34 35 33 35 33 42 36 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 35 42 44 35 39 30 33 43 34 35 33 35 39 30 34 30 31 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590307BD5903C453590419535905191032535906C45353B6C4C4C404BD590305BD5903C4535904015353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_119{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 37 42 44 35 39 30 33 43 34 35 33 35 39 30 34 43 34 35 33 35 39 30 35 31 39 31 30 33 32 35 33 35 39 30 36 43 34 35 33 35 33 42 36 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 35 42 44 35 39 30 33 43 34 35 33 35 39 30 34 30 31 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590307BD5903C4535904C4535905191032535906C45353B6C4C4C404BD590305BD5903C4535904015353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_120{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 44 35 39 30 33 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 BD590303BD53B63A19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_121{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {42 38 42 36 33 41 31 39 30 33 33 32 31 39 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 B8B63A1903321904BD590303BD53B63A19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_122{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 31 34 43 42 38 32 41 42 38 42 36 34 44 42 38 32 41 42 36 42 38 34 45 42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 42 38 31 33 31 32 42 36 33 41 31 39 30 34 42 36 31 39 30 31 42 36 43 30 33 41 42 38 33 41 31 39 42 38 31 39 30 33 31 39 42 45 42 36 33 41 30 31 32 44 32 43 31 39 42 38 42 31 33 41 31 39 42 36 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 32 44 32 43 42 38 32 41 42 36 32 44 32 43 42 38 41 37 } //1 014CB82AB8B64DB82AB6B84EB83A19B83A190332C0C03AB81312B63A1904B61901B6C03AB83A19B8190319BEB63A012D2C19B8B13A19B61904321903322AB62D2CB82AB62D2CB8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_123{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 33 35 39 30 35 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 33 41 31 39 30 33 33 32 31 39 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 53590503BD53B63A19B8B63A1903321904BD590303BD53B63A19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_124{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 33 41 31 39 30 33 33 32 31 39 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 06BD590313535904B853590503BD53B63A19B8B63A1903321904BD590303BD53B63A19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_125{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 39 35 33 35 39 30 35 43 34 35 33 35 33 42 36 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 31 33 35 33 42 36 43 34 43 34 30 31 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 35 39 30 35 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 43 34 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590306BD5903C453590419535905C45353B6C4C4C404BD590303BD53B6C4C419103206BD590313535904135359051353B6C4C40106BD5903C45359041353590505BD590313535904C45353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_126{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 43 34 35 33 35 39 30 35 43 34 35 33 35 33 42 36 43 34 43 34 43 34 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 31 33 35 33 42 36 43 34 43 34 30 31 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 35 39 30 35 30 35 42 44 35 39 30 33 31 33 35 33 35 39 30 34 43 34 35 33 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C4C404BD590306BD5903C4535904C4535905C45353B6C4C4C404BD590303BD53B6C4C419103206BD590313535904135359051353B6C4C40106BD5903C45359041353590505BD590313535904C45353B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_127{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {43 34 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 31 33 35 33 42 36 43 34 43 34 30 31 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 33 35 33 35 39 30 35 30 34 42 44 35 39 30 33 43 34 35 33 35 33 42 36 43 34 43 34 31 39 31 30 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 31 33 35 33 35 39 30 35 43 34 35 33 42 36 43 34 43 34 43 34 30 36 42 44 35 39 30 33 43 34 35 33 35 39 30 34 31 39 31 30 33 32 35 33 35 39 30 35 43 34 35 33 42 36 43 34 31 33 43 34 31 33 43 34 43 34 43 34 41 30 } //1 C4C4C419103206BD590313535904135359051353B6C4C40106BD5903C45359041353590504BD5903C45353B6C4C419103206BD59031353590413535905C453B6C4C4C406BD5903C4535904191032535905C453B6C413C413C4C4C4A0
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_128{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 33 33 43 31 30 42 44 35 39 30 33 31 32 35 33 35 39 30 34 31 32 35 33 35 39 30 35 31 32 35 33 35 39 30 36 31 32 35 33 35 39 30 37 31 32 35 33 35 39 30 38 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 } //1 033C10BD590312535904125359051253590612535907125359081253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_129{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 33 33 43 31 31 42 44 35 39 30 33 31 32 35 33 35 39 30 34 31 32 35 33 35 39 30 35 31 32 35 33 35 39 30 36 31 32 35 33 35 39 30 37 31 32 35 33 35 39 30 38 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 35 39 31 30 31 32 35 33 } //1 033C11BD590312535904125359051253590612535907125359081253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253591012535910125359101253
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_130{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 31 30 31 30 35 34 35 39 } //1 10105459101054591010545910105459101054591010545910105459101054591010545910105459101054591010545910105459101054591010545910105459101054591010545910105459101054591010545910105459101054591010545910105459
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_131{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {31 35 33 36 31 30 42 43 35 39 30 33 31 30 35 35 35 39 30 34 31 30 35 35 35 39 30 35 31 30 35 35 35 39 30 36 31 30 35 35 35 39 30 37 31 30 35 35 35 39 30 38 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 35 39 31 30 31 30 35 35 33 41 42 42 35 39 31 39 42 37 42 38 33 41 31 30 42 43 35 39 30 33 31 30 35 35 35 39 30 34 31 30 35 35 35 39 30 35 31 30 35 35 35 39 30 36 31 30 35 35 35 39 30 37 31 30 35 35 35 39 30 38 31 30 35 35 35 39 31 30 31 30 } //1 153610BC5903105559041055590510555906105559071055590810555910105559101055591010555910105559101055591010555910105559101055591010553ABB5919B7B83A10BC590310555904105559051055590610555907105559081055591010
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_132{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 35 39 31 31 31 30 35 34 } //1 59111054591110545911105459111054591110545911105459111054591110545911105459111054591110545911105459111054591110545911105459111054591110545911105459111054591110545911105459111054591110545911105459111054
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_133{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 42 42 35 39 42 37 31 39 42 36 31 32 42 36 42 36 33 41 31 33 31 39 42 36 33 41 31 39 30 34 42 36 31 39 30 31 42 36 43 30 33 41 42 38 33 41 31 39 42 38 31 39 30 33 31 39 42 45 42 36 33 41 30 31 32 44 32 43 31 39 42 38 42 31 33 41 31 39 42 36 31 39 30 34 33 32 31 39 30 33 33 32 32 41 42 36 32 44 32 43 42 38 32 41 42 36 32 44 32 43 42 38 41 37 } //1 59B719B612B6B63ABB59B719B612B6B63ABB59B719B612B6B63ABB59B719B612B6B63ABB59B719B612B6B63ABB59B719B612B6B63ABB59B719B612B6B63A1319B63A1904B61901B6C03AB83A19B8190319BEB63A012D2C19B8B13A19B61904321903322AB62D2CB82AB62D2CB8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
}
|
|
rule _#Exploit_Java_PrevalentPattern_134{
|
|
meta:
|
|
description = "!#Exploit:Java/PrevalentPattern,SIGNATURE_TYPE_JAVAHSTR_EXT,01 00 01 00 01 00 00 "
|
|
|
|
strings :
|
|
$a_01_0 = {30 31 34 43 42 38 32 41 42 38 42 36 34 44 42 38 32 41 42 36 42 38 34 45 42 38 33 41 31 39 42 38 33 41 31 39 30 33 33 32 43 30 43 30 33 41 42 38 33 41 42 38 33 41 31 39 42 38 42 36 33 41 31 39 30 33 33 32 30 36 42 44 35 39 30 33 31 33 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 33 41 31 39 30 33 33 32 31 39 30 34 42 44 35 39 30 33 30 33 42 44 35 33 42 36 33 41 31 39 42 38 42 36 30 36 33 32 33 41 31 39 30 31 30 36 42 44 35 39 30 33 31 39 42 36 35 33 35 39 30 34 42 38 35 33 35 39 30 35 30 34 42 44 35 39 30 33 31 33 35 33 35 33 42 36 43 30 33 41 31 39 31 39 30 34 42 44 35 39 30 33 42 38 35 33 42 36 43 30 33 41 31 39 42 36 33 41 30 31 32 44 32 43 31 39 42 38 41 37 } //1 014CB82AB8B64DB82AB6B84EB83A19B83A190332C0C03AB83AB83A19B8B63A19033206BD590313535904B853590503BD53B63A19B8B63A1903321904BD590303BD53B63A19B8B606323A190106BD590319B6535904B853590504BD5903135353B6C03A191904BD5903B853B6C03A19B63A012D2C19B8A7
|
|
condition:
|
|
((#a_01_0 & 1)*1) >=1
|
|
|
|
} |