(YARA) Detect_Interrupts

Download Raw

rule Detect_Interrupt: AntiDebug {
    meta: 
        description = "Detect Interrupt instruction"
        author = "Unprotect"
        comment = "Experimental rule / the rule can be slow to use"
    strings:
        $int3 = { CC }
        $intCD = { CD }
        $int03 = { 03 }
        $int2D = { 2D }
        $ICE = { F1 }
    condition:   
       uint16(0) == 0x5A4D and filesize < 1000KB and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
INT3 Instruction Scanning U0105 B0001.025
INT 0x2D U0129 B0001.006
ICE 0xF1 U0130

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
Fb2EDL.exe 5 2025-10-05 1 day, 13 hours ago
a.exe 7 2025-10-03 3 days, 11 hours ago
program.exe 6 2025-10-01 6 days, 3 hours ago
LoadThatPe.exe 5 2025-09-29 1 week ago
TV Logo Changer v1.1.0.exe 5 2025-09-28 1 week, 2 days ago
Lab01-04.exe 6 2025-09-26 1 week, 3 days ago
Lab01-03 (1).exe 4 2025-09-26 1 week, 3 days ago
Lab01-02 4 2025-09-26 1 week, 3 days ago
Lab01-02.exe 5 2025-09-26 1 week, 3 days ago
botnpwds.exe 10 2025-09-24 1 week, 5 days ago
View All

Created

June 22, 2022

Last Revised

June 22, 2022