The other method of writing a signature is pattern matching. Patterns can include simple human-readable strings and also complex binary strings. To write detection on binary strings, one needs to understand reverse engineering concepts such as disassembly and debugging, and have a good understanding of assembly language.

A malware signature can be composed of hashes, human-readable strings, and binary strings. YARA is a famous pattern matching tool used to identify malware. Here is a reference to the YARA tool: http://virustotal.github.io/yara/. You can read about writing YARA signatures here: https://yara.readthedocs.io/en/v3.7.0/.

The following screenshot is from the Locky ransomware's unpacked sample or its virtual memory:

The following is a YARA signature meant for Locky:

We mentioned the strings found in ransomware in Chapter 6, Case Study of Famous Ransomware. Also, in Chapter 2, Malware Analysis Fundamentals, we talked about the strings found in different kinds of malware. Readers can use those strings in their rules.