← Back to SOC feed Coverage →

MicrosoftVisualCV80

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-22T23:00:00Z · Confidence: medium

Hunt Hypothesis

This rule identifies potentially compromised or malicious Visual C++ binaries by matching specific code patterns, indicating that an adversary may have deployed custom tooling or backdoors within the environment. Proactively hunting for these signatures allows the SOC team to detect low-severity threats that might evade traditional signature-based detections, ensuring early identification of suspicious executables before they can establish persistence or execute further malicious actions.

YARA Rule

rule MicrosoftVisualCV80
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 68 [4] E8 [4] BB 94 00 00 00 53 6A 00 8B [5] FF D7 50 FF [5] 8B F0 85 F6 75 0A 6A 12 E8 [4] 59 EB 18 89 1E 56 FF [5] 56 85 C0 75 14 50 FF D7 50 FF [5] B8 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer_compiler_signatures.yar