Bonus Stack String Challenges

Here are two additional samples that may require some creative detection and analysis. Examine the samples and see if you can create three rules for each: one rule for unique regular strings; one rule for specific instances of obfuscated or stack strings; and one rule for generic detection of stack string patterns.


Zip of samples (password is ‘infected’): lab-stackbonus.zip

https://drive.google.com/file/d/1pkrSjExvfzfv5pId2CDJUn-W8CSeFw1D/view?usp=share_link


A) fb2fbca3be381bb1a0b410f66e04f114 (House of Cards)
B) 80dad66d6224d18babd9ada4a26aee75 (Ixeshe)


House of Cards - Hints
See offset 0x536



Is this an actual stack string? Maybe, maybe not! Can you codify this pattern into a YARA rule anyway?

Ixeshe - Hints
See offset 0x415e
