NirSoft’s MailPassView is another abused tool.

Note that this rule is more performant than the previous NirSoft rules because of the filesize check. This makes it more likely to match on MailPassView itself but may produce false negatives for samples that bundle this software.

rule mailpassview
{
	meta:
		description = "NirSoft MailPassView"
		reference = "https://www.nirsoft.net/utils/mailpv.html"

	strings:
		$ = "IncrediMail" wide
		$ = "NirSoft" wide
		$ = "PassView" wide

	condition:
		uint16(0) == 0x5a4d and filesize < 1MB and all of them
}

YARA Rules Index