{"bundle_version":"1.0","source":"SandiSeal-Pusat","exported_at":"2026-11-15T07:19:55.201864+00:00","count":1,"vaccines":[{"rule_name":"SandiSeal_Vaccine_f3d6b5a8","pattern":"eval(","file_format":"PDF","enabled":true,"created_at":"2026-11-14T06:53:26.501347+00:00","yara_file":"SandiSeal_Vaccine_f3d6b5a8.yar","yara_preview":"rule SandiSeal_Vaccine_f3d6b5a8 {\n    meta:\n        author = \"Kertopati AI Threat Analyst\"\n        created = \"2026-11-14T06:53:26.501921+00:00\"\n        source_unit = \"Hacker Uploader (CVE-2026-91814)\"\n        file_format = \"PDF\"\n        severity = \"CRITICAL\"\n        mitre_attack = \"T1027 Obfuscated Files or Information, T1553.002 Code Signing, T1059.007 JavaScript, T1204.002 Malicious File\"\n        sample_sha256 = \"f3d6b5a8c97fcf19576a7cc397731f82bbfd9505a4e6841c79b887e6b0fe3ea1\"\n    strings:\n        $ioc = \"eval(\" ascii nocase\n        $decoded_cmd = \"app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')\" ascii wide nocase\n    condition:\n        uint32(0) == 0x46445025 and ($ioc or $decoded_cmd)\n}\n","ai_analysis":{"severity":"CRITICAL","mitre_attack":["T1027 Obfuscated Files or Information","T1553.002 Code Signing","T1059.007 JavaScript","T1204.002 Malicious File"],"decoded_payload":"app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')","extracted_script_preview":"eval(String.fromCharCode(97, 112, 112, 46, 97, 108, 101, 114, 116, 40, 39, 83, 73, 77, 85, 76, 65, 83, 73, 32, 69, 88, 80, 76, 79, 73, 84, 58, 32, 87, 83, 99, 114, 105, 112, 116, 46, 83, 104, 101, 108, 108, 32, 45, 62, 32, 104, 116, 116, 112, 58, 47, 47, 99, 50, 45, 97, 116, 116, 97, 99, 107, 101, 114, 46, 108, 111, 99, 97, 108, 47, 98, 101, 97, 99, 111, 110, 39, 41))","deobfuscated_script":"app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')","obfuscation_layers":["String.fromCharCode"],"embedded_files":[],"shannon_entropy":4.69,"detected_apis":["app.alert","eval(","WScript.Shell","String.fromCharCode"],"risk_score":81,"c2_indicators":["http://c2-attacker.local/beacon"],"commander_brief":"Analisis dokumen sim_cve_2026_91814_shadow.pdf menunjukkan Risk Score 81/100 dengan indikator Shadow Attack pada byte 117616 serta penggunaan objek berbahaya /JS dan /JavaScript. Hasil deobfuskasi dari fungsi eval dan String.fromCharCode mendeteksi API WScript.Shell dan app.alert yang mengeksekusi payload menuju C2 http://c2-attacker.local/beacon.","sigma_network_rule":"title: Kertopati Auto-Sigma - SandiSeal_Vaccine_f3d6b5a8\nid: 5526745a-4add-5fcb-a7b8-397438cbff14\nstatus: experimental\ndescription: Aturan SIEM/Firewall otomatis dari Auto-Sandbox Kertopati untuk sampel sim_cve_2026_91814_shadow.pdf\nauthor: Kertopati AI Threat Analyst\ndate: 2026/11/14\ntags:\n    - attack.t1027\n    - attack.t1553.002\n    - attack.t1059.007\n    - attack.t1204.002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: 'eval('\n        DecodedPayload|contains: 'app.alert(SIMULASI EXPLOIT: WScript.Shell -> http: c2-attacker.local beacon)'\n    condition: selection\nfalsepositives:\n    - Tidak ada pada korpus baseline bersih Kertopati\nlevel: critical\n","validation_status":"VALIDATED (0% FP on Baseline)","recall_test":"PASS","false_positive_test":"PASS","analysis_mode":"Gemini AI (gemini-flash-lite-latest)"}}]}