← Back to SOC feed Coverage →

PseudoSigner01MacromediaFlashProjector60Anorganix

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-13T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies potential malicious activity involving a pseudo-signed executable mimicking Macromedia Flash Projector components, which adversaries often use to evade signature-based defenses and establish persistence. SOC teams should proactively hunt for this pattern in Azure Sentinel to uncover stealthy initial access attempts that may be overlooked by standard low-severity alerts due to their legitimate appearance.

YARA Rule

rule PseudoSigner01MacromediaFlashProjector60Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner01MacromediaFlashProjector60Anorganix detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar