Create encrypt-data-using-rc4-via-systemfunction033.yml

[dstepanic]

Hi,

This rule is pretty much a duplicate of the existing rule (SystemFunction032), it's paired with another undocumented API (SystemFunction033) that implements encryption/decryption using RC4 algorithm. Thanks!

References

• 0f33c2fec223823f84a732ceb1ad94ed2645e896095144850cf1443aeda67da6
• https://www.blackhillsinfosec.com/avoiding-memory-scanners/

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[williballenthin]

Thanks @dstepanic!

We should get the test file added too, though since it's shellcode I'm not sure it'll work in our test harness.

Are you able to sign the CLA? After I'd be happy to merge this PR.

[dstepanic]

Thanks @williballenthin. Yes, I signed the CLA yesterday. Appreciate it.

[mr-tz]

please rename per the lint info:

• FAIL: filename doesn't match the rule name: Rename rule file to match the rule name, expected: "encryptdecrypt-data-using-rc4-via-systemfunction033.yml", found: "encrypt-data-using-rc4-via-systemfunction033.yml"

I've added the testfile to capa-testfiles.

[mr-tz]

file and rule name still don't pass the linter

[mr-tz]

Thank you!!