Chm File Executes Js Via Powershell
This YARA rule detects Compiled HTML Help (CHM) files based on specific internal strings related to their structure and compilation. The rule identifies CHM files that contain internal data space and compression references, as well as specific compiler signatures such as "Free Pascal's chm package 3.0.4", "CHMCmd 3.0.4", and "HHA Version 4.74.8702". While the rule's name suggests detection of JavaScript execution via PowerShell within CHM files, the current string-based logic primarily focuses on the file's internal characteristics and compiler metadata, which can be indicative of potentially malicious CHM files used in attack campaigns.
YARA
