Casing_Anomaly_PS1_StringChar

Rule Info

Minimum Yara
1.7
Av Ratio
22.01
Score
60
Description
Detects suspicious casing of [String][Char] string
Name
Casing_Anomaly_PS1_StringChar
Date
2020-12-15
Tags
['SUSP', 'CASING', 'SCRIPT', 'T1086', 'T1059_001', 'T1027']
Required Modules
[]
Reference
Internal Research
Rule Hash
e12bf7f726b783ba152eeb73a40894f2
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
64
Suspicious (< 10 engines)
65
Clean (0 engines)
10

Rule Matches

Hash
Total
Timestamp
Positives
VT
a3869df4fd1002dc28388725282ae6838e8976f9593c853c8fa976dc5ffd9f30
59
2021-12-08 02:59:53
37
3dc46347bb4c532a768277cb3afac4d4bb1ff864450d4de91194b67f861b71f9
57
2021-12-03 21:10:01
15
8cee76eeac4a0e509279366ad317e56f535fb49138036269ecfff57b234a6a07
48
2021-12-02 19:22:21
12
6adf809ce4d7c504a171defe60fdd1a81f29a3d6588d665cf50ebfe6a8748766
55
2021-12-02 12:37:21
3
bedb4f67b952c8fe79b024efd4189138ded03c04b550f1c1553f646fd14100bb
57
2021-11-29 12:18:38
21
b896b56713c41123a7b893abc52519b83dd594ea2febcc390abb812f3878005e
56
2021-11-27 16:24:20
26
7708b5f0799a4ee2bde37128471c6c598ac28194385a1dbb66ee22cb33f2c4dd
56
2021-11-26 19:47:08
4
dec7c87188c6ce3af2b07eaa49204f2ae9557cdea456819f79d8f37ea45af675
55
2021-11-24 18:41:25
13
d273c0014716019e18b11195028b4cd860ac26a9d4633cf334598f2649d60e12
55
2021-11-22 14:13:05
12
938442dec293461256844290bf84ee044dde9b67a764141381f0d96db42ebd4c
56
2021-11-19 19:09:42
1
d90b02d0b842443fe71cbce34d42559bf67367d394501c1f8af000e394544e44
66
2021-11-19 12:09:42
7
82b5d01bd0c123c6fee6a86bef09b06d51850b6032e7599a7e305a9c8934cdf9
55
2021-11-17 21:41:31
5
75d62f9a0ef6c1ada063ea3d48b6351dcfca1bac35a2f41949dd40b7ba99fdd2
56
2021-11-17 21:23:41
2
8c6ac54db098c73eaafa31a642a72e57de836ff41ca9a40b97b55c68ece6c90b
56
2021-11-17 11:31:39
13
636668d21e6a2e90f665677593b1ed76da8613ececa20f59237a2910098b94e5
56
2021-11-16 14:27:52
2
19f15ce1fd408298f6df40b34ec67a28ca0247eb66575ddda1784d42f8221fa1
55
2021-11-16 14:26:46
2
0ff8fb85641fbb4b75b220fa38f250eff924ae939c11256be3bf9561c81cd2f8
57
2021-11-15 19:51:19
14
2c1086f24eed301c201b1ac8677812bea6a77324418e8a4418aaf375ec136374
55
2021-11-15 19:46:35
12
0f72b6caa2364ab9e8a36366b0d70afbcd4fcb1f82b45ce9aaa06a6c21c985f4
56
2021-11-15 19:06:22
11
20ddd3df0e4b7110c7f30e2a9ae0c35d5b90c1d454b20fb8240f4e3a6899370a
56
2021-11-15 19:05:39
1
870b42a8dcb08256b6a7f1d9bd571c61005473b6be45dd4dbc81ff37a4eafaa4
55
2021-11-15 17:22:04
11
f74aac646961a5f9d297a02062d32a5b4e701f8239eb261998e791041d267203
55
2021-11-14 20:28:50
3
dd9d0f767ff68b28b19080a66d5fd7990e25fe7a9105ba39de9a6964f178ac73
57
2021-11-10 12:14:49
4
d7130e42663e95d23c547d57e55099c239fa249ce3f6537b7f2a8033f3aa73de
61
2021-11-09 18:08:52
40
c7484a31a7f80410a0afb27f9f65937fac98e44dd538a88ef1b7dae668735ed1
61
2021-11-08 09:35:57
44
984d37707bd62df873879d999d97f5d498ddc23d3e8f2acdcc7ca8d819f0a3e9
55
2021-10-27 13:35:45
2
b79fa72cdb5a08d7e4baa0ac6aecf8ec627930c9c46cc08542dc6a5c65fbba10
57
2021-10-22 18:32:41
2
31e3d37c41a91ca4c1ad6e29820474cbe1cecab1ed137b2683969d22698825c7
56
2021-10-22 18:27:19
4
b72e7da864c3f98b33e7c03b1ee2d3d318f5367a8d1af68c5b54239218c5b754
57
2021-10-12 16:39:47
2
32444004c5e29abccfc6a56343f1f1b0e57b3f8f60512305809f3506e9bee627
57
2021-10-12 12:15:28
2
3dd8c26324d94aaf732c168e27995508ef518944bf7c7bfe8a9755764268a853
56
2021-10-12 12:11:43
15
8190cdabba69ca1d6436d5f59d4b46095771160f724d08a69a603a9f93755422
57
2021-10-04 12:39:47
3
ad5b707c361a8a8110e95de8d1616e2d951d9666799e2cb77965550a52091f8b
57
2021-10-04 12:36:07
5
d943bc6dc7614894cc1c741c6c18ac2dbd2c5069f3ab9bc9def5cc2661e54dee
57
2021-10-01 14:34:31
37
badb986eb2e067914b1132120a20aef00de4f8e3b3ece371b04307360deb2fc3
56
2021-09-30 14:24:17
7
af35775ffec52ecc52d322743f247e2f51059fe04574b0252290d1ed58359288
57
2021-09-26 18:39:13
1
ea3a4ff72748a18004edd457e97f33fe28a56960b2b42e1b46df33528f4f5b33
57
2021-09-26 18:38:05
1
845416d20089d15af45eaa727bce7f594739ba09854219f6d3c26ac226dc1864
57
2021-09-26 18:35:50
2
7bdfdcf92ecdb2e40091bb34834fdadced64363eb2d1a572979e8fdb88cd78ca
57
2021-09-26 18:30:08
0
e1148cabb3128e4a48d87296efdd580f623b84d84862918315b6324e701f6f09
56
2021-09-26 18:26:46
3
1515dab0b35ad52a6fd9e8949fa638a3532780c99d1b911cd53bbdca94ec7fb7
57
2021-09-26 18:18:44
8
51ca484b0958161311a61912da60e9b5950607cd23618a1971af0a7f8234c8e8
56
2021-09-26 18:18:42
2
6115a2ef1f6c217688c3fbfe9a686eedfa8c45ade51b5d78748f96ad44e26ea7
57
2021-09-26 18:18:40
1
f7e49d0f271204e854d5fb63704ed12a85e4beb9e5d82688c799cdb49684a7e3
57
2021-09-26 18:17:33
0
2e9a89c823b3e1c3546240ebb09a0715ac4693e113e53486d09169d1f15316b4
57
2021-09-26 18:17:33
0
aa7de0f493afa94e14a742af790daf343878037cd326703d231eedbfc613213c
56
2021-09-20 18:31:41
4
50863c447e8f2ba85547c59ea26c32814bf96db625e851c5b696e8326e507b54
57
2021-09-20 17:38:30
30
4f2cca77e516f08388a69137339b4fc23e3e5b8a35d766c46dc59bae24262029
57
2021-09-18 19:22:09
2
b9e3afc4b34e70bbfbb08ab652a040e44b40ddce791751d23169d4ea579eff04
57
2021-09-18 19:17:47
7
468ccc2d33ea643f8e54f76eac031004a87777fc52f0312cec61d6cd7b2e9855
57
2021-09-18 16:09:45
8
33e1268c350269b17857c7064bbb12400e944cf99bf9700471d0afe32a07327e
57
2021-09-18 16:04:06
21
927c4de012da5dadd83a10fa111c60668bd25febde6320a7b826c889c2c3892a
57
2021-09-15 16:28:52
0
b5d9f25d0cc50fa48698e0bb69647a42c03b4d6179e5c471686360bd653382d6
58
2021-09-08 14:22:59
16
d94a046440e764fee19721e562f3d08084a3456ce538bc5788a919c2ecdbbd85
57
2021-09-07 19:54:06
4
71f9d86ebd60f4d98cff83f3e0386f09bf78026277c6a2cb27f95e0660c16a57
57
2021-09-07 19:34:34
4
aeeeaa4ff80c03622f3bf319d6a1487b221781331b55c6a87d94d8c5a17ecd42
68
2021-09-07 18:01:30
14
23404196b1caba397b76a7152476b687eb20f4e10191e4fc4324f4dcc1f478fc
57
2021-09-07 12:38:02
4
491e6c5e61107b379e126d751c0f5a3ba4b2be74b200a4ae775d6c25740fc5f2
56
2021-09-07 11:48:33
5
1d1fac4956df1c73297a7f7ec5d2b7afd78670e5c42c3b1b4f4baea4bfc0f7d5
56
2021-08-30 18:45:14
2
d42ae75dccdf36ea63441529a3afa5c0197eac40f9fd9e443c3532bec107925a
57
2021-08-26 12:01:58
13
801f8ffc72692c1c01ce8a492d13e06bc4cf7d1a1cef5ed6e4178e456fa868cb
57
2021-08-25 18:23:12
0
df3211adc05ead77f4e7f172dd1439e2540d1e98df089e478aaf0a37e747b858
57
2021-08-25 18:10:25
10
1615146bece6c1151b52becae14a76a401f5dee53e1db97c4e4205715d0099c6
61
2021-08-25 17:10:44
43
3a4e6600effb0c79f871b0699cb03c2ddd682e21ce7fb38f49f5580bbb94ca5a
56
2021-08-24 20:08:49
6
11ba388ecec113e6624c2997eec7e3efb78da9228fee23c43f23a69ceac7db99
62
2021-08-20 02:27:57
44
861f712574c474048447724f7b5b1d761360da9d031d9d6f96a20030654ad4f1
58
2021-08-16 12:15:13
0
8391535704409dc8be17d7f5223e414f1b2b614424f1d0f1654262f0a2c6db44
68
2021-08-12 18:50:54
31
2947ab931088e5eadcebadc92478b156f4bffc33a811cdd9a550e68e4e66bb6e
59
2021-08-10 10:41:43
3
a65128e5059367912ca6ed29c30bdcb1262aef8c7e46cdabb62a794608757808
58
2021-08-09 14:27:05
2
56923bc29f73a61a7a03270687cc7a335db40411ed87d45498a36338af8cf27f
58
2021-08-09 12:57:12
5
ff2c6b985cb6cda2e97539f0a0133cf637c092cca278e95fd106bc066e30a44c
59
2021-08-03 18:44:37
16
43ae09159f3b1a4d2b49be07a979ff1ef0dde7d9d9a137c9102889d68245c21d
58
2021-08-03 15:29:40
14
d7ea00472fec49f08886954cfd8593bada7bdd456888d2056d9d085614b15481
58
2021-08-01 13:18:42
5
d05f2ddcd952fcf92ec3d90f1eb44c27bb5aeadd246aa8f4912cfa3e04429899
58
2021-07-29 20:05:50
1
ca286fb5ace0b894e653633094590b628b5bf56eb43fa33b2857c3e3b478949e
59
2021-07-29 14:28:45
20
ac52108480d9f135b36fad44c0d62da05882ffbe9d982c6406b8d679972c4dd5
58
2021-07-20 16:42:26
3
4233ebbff02378aa2db5ed3815989fcb1dabfd9282f749cda2e1c543dd3cff2f
70
2021-07-19 11:15:31
47
7bdf7722115be910e2b301b3f6b3037bc4b987c588838cd2459aeeeec9f50be7
62
2021-07-15 09:44:39
44
7273f1984d6f630c4b386226adb0a8e3f478ef5fc6e69a56a34f6ca5e16cb4a5
57
2021-07-12 17:07:25
4
a9220c7515fd914903aabddeb8beff986bb71f7c4b3a9c036100c22b58605f69
58
2021-07-12 17:06:16
1
eb87a3c30e75fe42d798590da6fb60af86cce28537152ee1d930cc5593c43999
58
2021-07-05 05:49:24
12
ffde7e472411894a84e2e9f8177b8f4854893e7f6d4270556edfeed18d2ad7d1
58
2021-07-05 05:46:05
13
f4f7c0193b73f70110766a9c92700cac32c33c9844e4e585e247ba9bd1ea75d6
56
2021-06-28 00:07:30
12
a3cbd4cd794f57fabcbad43852f342a2ac92df7736caf6adf3a672f0985b782f
59
2021-06-25 18:18:50
18
bf3df7a0031f5b7479ff9ce0cc30fe7552fa1591a9e33105d077a349b1722284
58
2021-06-23 17:22:23
15
9e42496f1c11d874f55500e62226d531d56e6d8685fcd086b30ec3f22c0be254
57
2021-06-23 17:22:23
9
0cd655470838905ffc26538a6f1a0bd6c0d038bf0ea6195263e3374087e679ba
58
2021-06-23 17:01:07
0
23d2ce533942921937475cfeeba7626a99c8aeca298a35e32b1571507dfc13e8
59
2021-06-23 16:57:57
13
8db7e9a1619f64a8c55ae69e8db4311465a8ef64c775be2d6b5e044718724af1
58
2021-06-23 16:55:01
12
fa65adc7d1bde7b1f62d6becb0660fa3f7b47d5ad559e06fee8a679719ddea7c
57
2021-06-23 16:50:26
9
1ff0ef0c48c4fc7abbc58dd20d79fd994adf7651a01e9f7056b8e13faac37bf9
58
2021-06-23 14:44:06
0
6a2da602e75c5f7f0cc892f740f6fb6ed9c2ea788911e14a0373d27f19d992da
58
2021-06-22 19:08:45
4
f946ddf9dbe51ce73434dcbbe861e1fd2eab142609015ffa77dfd4259cb3b30f
56
2021-06-22 16:49:39
1
789b02998e75850c6b05a4176e31ddfb5dc2afb7f107fcb959f8ab7b0ed805d4
56
2021-06-21 17:05:25
2
ac0f084b80fd060735760281d3ec61733f58e6b8447d50d3c45cc1569b8e8695
59
2021-06-21 11:40:32
12
9248e8cf4a05a03226e51b78db516a9dfbcfb338d82cd3d569a62e7c83572969
57
2021-06-21 11:38:13
14
757d51efe0d731546431c6295eecacce5fff1a0a5682572a006f7fa46bd133af
58
2021-06-21 11:30:06
14
44875471e07168ad86a45d1526f2fd76f9ed18bf16979cc647f725b394d3b51c
70
2021-06-19 15:37:50
49
d4f3ec8c13b02f590b9f5abc986e31ec937c6dfa6f4423fd1a577103eb08d224
67
2021-06-10 02:08:06
48
36569d472e6995d650525f16ae2c13285d1fff95b61873fac534fbe45123474b
58
2021-06-04 20:26:49
4
884cd5992e2a00be79ec8a4198bd8703baa1021d3706b8ae7214ad932376b3af
58
2021-06-04 09:59:19
0
395b2f396a492856b46d2aef76fbfcf12d2ecfa418458a4d6b35e639020873b0
59
2021-06-03 21:14:56
19
7636c70f6672b67fb149008ab4a44e757cdee63681505ae30e982b7f80998f37
58
2021-05-31 23:31:14
1
9652b069d8448fe802ab33f169fe1d26f493b71c13a01ed074e96555bfb45299
58
2021-05-30 20:40:32
16
bc293f587469ebc58a69af9d78ccb6a44cc393e3543910535a68b2604c5136a2
59
2021-05-21 17:39:50
10
141ce42b67807fa206c54653020c8365197612844535ccca2cab2c369be4fa71
57
2021-05-20 22:17:20
4
8dff8c055205be8ccca6fc48d21084cc56f54bbfde1050722f8320030fb23d6c
61
2021-05-20 21:48:03
42
f530b775e0b50efc15cfd9f595f097523b6a0c40e533319de40f10a756722844
57
2021-05-19 20:42:32
10
56d23cbdc748a2236ea73fc63dbdb62904c671db5eefa59b5cfa3f555a8a9e2b
60
2021-05-19 19:26:30
39
d7b1a8195f02f8b9c181de7ce3915ff9f447881e684e1445a04641d84778e8ea
60
2021-05-19 18:28:01
45
f308c9c25287e95d166ce7370f2bc27760f0503e3f05943317faac4f1f0e35d5
57
2021-05-19 01:42:20
1
38ab75d39e64934e129b3b9a3f2a2af0ea866b28bf6de6700e3b5ba979629c6e
41
2021-05-13 20:49:39
24
e613675c5c94ad210613d5ba04caf68d1af5affdd062c0bc3832b440599a33e8
60
2021-05-10 11:26:43
3
49d568eeb47b7ca0bd1408911c39474b3096b199b32f624213d09c28d76f73d1
58
2021-05-09 18:22:40
1
76d03a098531bb2c0ce803efddc89231ea090922777c3f7370d4a7d351b1d4ef
58
2021-04-30 12:19:51
5
2843322b6801065cc4c2cd493398f0eb1fad22620e964b12b571065700cf4282
56
2021-04-25 10:21:56
41
effc9b74767d6123ba4afcb80a91e961a53484d2c880d49fbe4d52122baa6180
61
2021-04-25 10:18:14
41
7fb9ce75409e6ed8505bc172d557ffa5dc714e798b96c7ee5b3162445ee20922
61
2021-04-25 10:17:56
43
f9ee566dd75bbe760c8b17b827e7c38e642ada500aaf5b87be6722b4b40de0d0
61
2021-04-23 18:42:20
41
7e434d61a118b36cf4bb69d3f1c5498b9962f0e054cfc77102fb32832e8e456b
59
2021-01-20 11:55:13
3
33e2c91033364b03fa22d2ef7a2cc5a0c19b7837c0a2750a4975eb755f49fa1c
59
2021-01-15 12:33:52
2
3a25521c7df4bb0a41fd689c3b3f99ff37d2ffe9ffd076fc5c4b1d856578827d
58
2021-01-15 12:25:27
10
e8f35840c0395b2b6b88648a46f86cd5fd3a4cd06217260b59cd25082897f6bb
62
2021-01-15 12:15:21
44
e85ed9d5f933a95594b20548de9ccd707910e92f953d0c590a13a2feb414eeaf
62
2021-01-15 12:15:20
44
635d5d6a92809b9fa1c6616954e1d795f5eff1c6876afffff8d82d8294922517
58
2021-01-15 11:42:12
13
d67e2df7b40af0867d346358baefd6b0c585339d176654b974c4a2846d018cf9
57
2021-01-15 11:41:51
10
6d8cb8d79c89ff9dff47daf07547c34b78995e6d0aa8fabb7c0ea0ffdaaf3629
58
2021-01-15 11:37:39
13
86ac4bb31f5bc6b319651fd1dc6a71801d09b0218aa32a34d53b975e2cd19c2a
63
2021-01-15 11:36:39
44
f129df33a5bb35589bf9f9cce485c11f0c12afe0c870d0b5d29f4f89b9a9be62
63
2021-01-15 11:36:28
41
12a72aaaebc81b0a6a16ad9d3ea596ea768f633766f70b97f5e4db2d1ee1f8d6
63
2021-01-15 11:36:18
43
e152edb2a451a5fce8a44714dad6bd60aa1d0c8995d4b04f4b8ce45f8068d1f7
62
2021-01-15 11:25:31
39
315184fc26be9b522ea5ef3a76a78b9988e3821069ac3bd7433b5a0efd764227
60
2021-01-11 10:31:30
7
abceb6cc3ea9482c768590ecd8ffd82ae5a7398d9c68ead98486eed1d7d7f215
56
2021-01-06 09:53:19
2
38041654138105cd1d43772147aa401894fb6c63a8a9f2d5e47448b503ffe1bb
60
2021-01-03 14:12:38
6
a720a73c0039591ec980e1c93701f7ee80128269044a0b71e8bec4d3f935f500
59
2020-12-30 11:33:50
1
fe5f91c00d0c6342044bf9c75224ac9926833d2bfd8c21fcdde2db1bee24ae05
60
2020-12-30 11:11:36
0
9249d8f9d7c3e631c9c43b96b682a0ae6010f975103200fc34629f6fdad65b52
60
2020-12-29 12:26:10
5
bd692820f688b10d9020399e540e1c075c5b00697f7d4b04f11d20d114e6309b
60
2020-12-20 19:40:29
3
898bd6eb9aff94e3b8eab1a2173d3d25154d4ff982cb689568c9c8477b39953b
60
2020-12-18 18:08:54
1

Rule Matches per Month (last 24 months)