api_hashes_permutations_e8c77835

YARA detection rule by filescanio
Rule api_hashes_permutations_e8c77835 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_permutations_e8c77835 : hardened
{
	strings:
		$ControlService = {((82 1a 0a 36) | (36 0a 1a 82))}
		$HttpSendRequestA = {((eb f4 22 37) | (37 22 f4 eb))}
		$SetThreadPriority = {((91 1b 4a e4) | (e4 4a 1b 91))}
		$Recv = {((8b 81 2d e8) | (e8 2d 81 8b))}
		$QueryPerformanceFrequency = {((d4 d9 53 52) | (52 53 d9 d4))}
		$RegDeleteValueA = {((ce 82 5b 0b) | (0b 5b 82 ce))}
		$GetWindowsDirectoryA = {((89 b2 dc 35) | (35 dc b2 89))}
		$CryptSetKeyParam = {((d7 b8 35 3f) | (3f 35 b8 d7))}
		$RegCreateKeyExA = {((b9 73 51 db) | (db 51 73 b9))}
		$Module32Next = {((ae ea 13 6c) | (6c 13 ea ae))}
		$RegOpenUserClassesRoot = {((95 74 3d 4f) | (4f 3d 74 95))}
		$NtReadVirtualMemoryEx = {((f2 22 1e df) | (df 1e 22 f2))}
		$InternetOpenA = {((f1 34 bd f7) | (f7 bd 34 f1))}
		$URLOpenBlockingStream = {((b5 56 ca bf) | (bf ca 56 b5))}
		$NtSetInformationThread = {((be 70 ec fc) | (fc ec 70 be))}
		$CreateFileA = {((92 91 5e 18) | (18 5e 91 92))}
		$UnhookWindowsHookEx = {((cd ee 13 af) | (af 13 ee cd))}
		$GetCurrentThreadId = {((f3 5e 40 eb) | (eb 40 5e f3))}
		$Accept = {((cc 77 10 1d) | (1d 10 77 cc))}
		$HeapReAlloc = {((80 5e 5e fc) | (fc 5e 5e 80))}
		$WinExec = {((ef 8b c2 62) | (62 c2 8b ef))}
		$NtQueueApcThreadEx = {((a2 0a 97 8e) | (8e 97 0a a2))}
		$VirtualAllocFromApp = {((9f a3 63 90) | (90 63 a3 9f))}
		$RegLoadKeyA = {((cf 26 53 90) | (90 53 26 cf))}
		$OutputDebugStringA = {((c3 ea d6 eb) | (eb d6 ea c3))}
		$GetFileAttributesA = {((a5 97 94 41) | (41 94 97 a5))}
		$SetWaitableTimer = {((ed fc f1 6a) | (6a f1 fc ed))}
		$SendMessageA = {((c1 35 1d 83) | (83 1d 35 c1))}
		$RegUnLoadKeyA = {((e9 62 e6 41) | (41 e6 62 e9))}
		$SetEnvironmentVariableA = {((8f e5 25 ae) | (ae 25 e5 8f))}
		$VirtualAlloc2 = {((c1 1c 1b d1) | (d1 1b 1c c1))}
		$CryptProtectData = {((8d fe b9 79) | (79 b9 fe 8d))}
		$GetDesktopWindow = {((d6 7d a7 1c) | (1c a7 7d d6))}
		$RegGetKeySecurity = {((99 cb 46 53) | (53 46 cb 99))}
		$GetDC = {((a4 4e e0 7a) | (7a e0 4e a4))}
		$LookupPrivilegeValueA = {((9d 58 3a 49) | (49 3a 58 9d))}
		$CryptGetHashParam = {((86 81 c7 d7) | (d7 c7 81 86))}
		$HeapAlloc = {((8f 4a 1e 73) | (73 1e 4a 8f))}
		$RegCloseKey = {((8f fd 31 12) | (12 31 fd 8f))}
		$CryptHashData = {((b3 d6 9f 66) | (66 9f d6 b3))}
		$GlobalAlloc = {((db 06 e5 fa) | (fa e5 06 db))}
		$RegOverridePredefKey = {((d4 32 2c 55) | (55 2c 32 d4))}
		$EnumSystemLocalesA = {((ce 2f c4 9a) | (9a c4 2f ce))}
		$GetProcessId = {((ec 76 9b f6) | (f6 9b 76 ec))}
		$RegLoadMUIStringA = {((ad 55 40 3e) | (3e 40 55 ad))}
		$SearchPathA = {((af 54 ab cb) | (cb ab 54 af))}
		$FindClose = {((a1 d5 1e f2) | (f2 1e d5 a1))}
		$NtDeleteValueKey = {((bd 22 73 70) | (70 73 22 bd))}
		$URLDownloadToFile = {((ef 2c 01 33) | (33 01 2c ef))}
		$Toolhelp32ReadProcessMemory = {((99 a7 ca cc) | (cc ca a7 99))}
		$GetProcAddress = {((a1 20 ef 54) | (54 ef 20 a1))}
		$OpenProcessToken = {((88 32 71 e5) | (e5 71 32 88))}
		$HeapCreate = {((e7 c6 c7 66) | (66 c7 c6 e7))}
		$UuidFromStringA = {((d5 10 08 2c) | (2c 08 10 d5))}
		$VirtualProtectEx = {((dd a2 b0 69) | (69 b0 a2 dd))}
		$GetSystemTimeAsFileTime = {((90 ef d7 7a) | (7a d7 ef 90))}
		$GetModuleBaseNameA = {((fb dd 42 15) | (15 42 dd fb))}
		$lstrcatA = {((dc 2c 88 d3) | (d3 88 2c dc))}
		$SetFileAttributesA = {((ac bb 99 77) | (77 99 bb ac))}
		$FindResourceA = {((e1 91 ba 23) | (23 ba 91 e1))}
		$WaitForMultipleObjects = {((e2 28 25 8e) | (8e 25 28 e2))}
		$QueryPerformanceCounter = {((ec ad 13 60) | (60 13 ad ec))}
		$NtCreateThreadEx = {((9e de d2 29) | (29 d2 de 9e))}
		$NtContinue = {((ac 8f 07 5c) | (5c 07 8f ac))}
		$IsWoW64Process = {((ad 8f 74 3d) | (3d 74 8f ad))}
		$DnsQuery_A = {((dd 55 8d 69) | (69 8d 55 dd))}
		$VirtualProtectFromApp = {((83 8f 21 b6) | (b6 21 8f 83))}
		$GetAsyncKeyState = {((c2 39 50 e3) | (e3 50 39 c2))}
		$EncryptFileA = {((ec 69 c3 a9) | (a9 c3 69 ec))}
		$DuplicateToken = {((92 1d 24 a3) | (a3 24 1d 92))}
		$CryptDeriveKey = {((c4 b6 cb 1e) | (1e cb b6 c4))}
		$LockResource = {((ff 8e 1b 51) | (51 1b 8e ff))}
		$ResumeThread = {((ee 8d 5a 09) | (09 5a 8d ee))}
		$WaitForSingleObjectEx = {((e1 4c 86 0e) | (0e 86 4c e1))}
		$NtSuspendProcess = {((bf 1f 3b 7c) | (7c 3b 1f bf))}
		$NetShareCheck = {((bc 0a b8 46) | (46 b8 0a bc))}
		$OpenThread = {((dd d3 53 29) | (29 53 d3 dd))}
		$URLOpenStream = {((fc d1 4e b6) | (b6 4e d1 fc))}
		$UnmapViewOfFile = {((af 83 43 f3) | (f3 43 83 af))}
		$CreateFile2 = {((99 cd 26 32) | (32 26 cd 99))}
		$DeleteService = {((a2 35 43 55) | (55 43 35 a2))}
		$GetThreadId = {((ec 82 ff 7b) | (7b ff 82 ec))}
		$RegDeleteKeyA = {((ef 46 4d 57) | (57 4d 46 ef))}
		$CreateTimerQueueTimer = {((f5 10 70 ba) | (ba 70 10 f5))}
		$SetProcessDEPPolicy = {((c0 2c 02 f1) | (f1 02 2c c0))}
		$CreateServiceA = {((ce ba 73 4a) | (4a 73 ba ce))}
		$ExitWindowsEx = {((d5 19 78 47) | (47 78 19 d5))}
		$NtMapViewOfSection = {((d5 a7 95 2a) | (2a 95 a7 d5))}
		$NtTerminateThread = {((d2 7f 75 f7) | (f7 75 7f d2))}
		$Process32First = {((88 72 ad 62) | (62 ad 72 88))}
		$RegCreateKeyTransactedA = {((b7 21 2e c9) | (c9 2e 21 b7))}
		$GetUserNameA = {((f1 da 68 6b) | (6b 68 da f1))}
		$MapVirtualKeyA = {((84 89 dc 8b) | (8b dc 89 84))}
		$WNetCloseEnum = {((b7 fb 1e fd) | (fd 1e fb b7))}
		$InternetReadFileExA = {((b2 cb 97 c2) | (c2 97 cb b2))}
		$GetComputerNameA = {((d1 ee 53 1a) | (1a 53 ee d1))}
		$RegFlushKey = {((b7 fe 0b e0) | (e0 0b fe b7))}
		$VirtualAllocEx = {((a2 fb c9 df) | (df c9 fb a2))}
		$GetSystemDefaultLangId = {((d2 53 1a 3c) | (3c 1a 53 d2))}
		$SetFileTime = {((d1 32 3f 53) | (53 3f 32 d1))}
		$SendNotifyMessageA = {((80 7d c6 55) | (55 c6 7d 80))}
		$LookupAccountNameA = {((84 ad 5e ed) | (ed 5e ad 84))}
		$NetShareEnum = {((d6 de 94 6d) | (6d 94 de d6))}
		$IcmpSendEcho = {((e0 dc b9 17) | (17 b9 dc e0))}
		$DebugActiveProcessStop = {((df 0c 49 c8) | (c8 49 0c df))}
		$NtCreateFile = {((cd 88 3a cf) | (cf 3a 88 cd))}
		$DecryptFileA = {((f0 f1 be f7) | (f7 be f1 f0))}
		$GetRawInputData = {((ac b2 a2 8a) | (8a a2 b2 ac))}
		$BringWindowToTop = {((98 b9 43 f0) | (f0 43 b9 98))}
		$NetShareSetInfo = {((be 38 ff 70) | (70 ff 38 be))}
		$GetLogicalDrives = {((82 c0 5e dc) | (dc 5e c0 82))}
		$WriteFile = {((fd c9 2a 23) | (23 2a c9 fd))}
		$BitBlt = {((d9 5a c4 91) | (91 c4 5a d9))}
		$SendMessageTimeoutA = {((eb 06 ab 36) | (36 ab 06 eb))}
		$GetCurrentProcess = {((eb 8a 75 49) | (49 75 8a eb))}
		$RegDeleteTreeA = {((e3 b3 ab f0) | (f0 ab b3 e3))}
		$CreateProcessWithTokenW = {((8e 78 2e c0) | (c0 2e 78 8e))}
		$FindWindowA = {((fe 2b c3 5b) | (5b c3 2b fe))}
		$CopyFileA = {((f4 93 c2 4e) | (4e c2 93 f4))}
		$FtpPutFileA = {((8c cc 1d c6) | (c6 1d cc 8c))}
		$NtOpenProcess = {((dc 98 2c de) | (de 2c 98 dc))}
		$Send = {((c5 99 87 a9) | (a9 87 99 c5))}
		$EnumDeviceDrivers = {((d0 18 bf 65) | (65 bf 18 d0))}
		$Process32Next = {((f4 1a 3a cf) | (cf 3a 1a f4))}
		$GetWindowDC = {((bb ee 6b b4) | (b4 6b ee bb))}
		$CryptDecrypt = {((d6 cd 04 43) | (43 04 cd d6))}
		$ReadFile = {((bf 9e 4e 2a) | (2a 4e 9e bf))}
		$VirtualProtect = {((b4 1f 90 5f) | (5f 90 1f b4))}
		$OpenProcess = {((f2 21 15 f0) | (f0 15 21 f2))}
		$WaitForMultipleObjectsEx = {((fb d1 97 dd) | (dd 97 d1 fb))}
		$Inet_addr = {((f9 b7 5f a5) | (a5 5f b7 f9))}
		$WSAStartup = {((c2 af e6 0a) | (0a e6 af c2))}
		$Bind = {((c5 19 f7 f8) | (f8 f7 19 c5))}
		$GetTempFileNameA = {((94 c1 75 c5) | (c5 75 c1 94))}
		$CreateMutexExA = {((ee 80 1e 37) | (37 1e 80 ee))}
		$DeviceIoControl = {((9d d5 40 b6) | (b6 40 d5 9d))}
		$CryptDestroyHash = {((9c 34 cf 12) | (12 cf 34 9c))}
		$CryptEncrypt = {((c9 2c a6 d4) | (d4 a6 2c c9))}
		$NtSetContextThread = {((e6 a7 da 32) | (32 da a7 e6))}
		$CryptReleaseContext = {((a4 90 e9 e3) | (e3 e9 90 a4))}
		$StretchBlt = {((d8 f6 c1 66) | (66 c1 f6 d8))}
		$NtWaitForSingleObject = {((f0 a5 d9 6c) | (6c d9 a5 f0))}
		$LoadLibraryExA = {((cd 7d 64 f2) | (f2 64 7d cd))}
		$PeekMessageA = {((c1 c5 d1 00) | (00 d1 c5 c1))}
		$WNetAddConnectionA = {((f3 31 6d ba) | (ba 6d 31 f3))}
		$NtCreateThread = {((b7 98 67 fc) | (fc 67 98 b7))}
		$ShellExecuteExA = {((b2 8b 83 16) | (16 83 8b b2))}
		$GetMessageA = {((bc 0c fa ba) | (ba fa 0c bc))}
		$GetCurrentHwProfileA = {((8d 06 49 68) | (68 49 06 8d))}
		$PostThreadMessageA = {((d5 79 bc 91) | (91 bc 79 d5))}
		$RegOpenKeyExA = {((ff 45 de 7b) | (7b de 45 ff))}
		$CreateWaitableTimer = {((89 fa c1 29) | (29 c1 fa 89))}
		$NtSetInformationProcess = {((d5 bf e0 3c) | (3c e0 bf d5))}
		$InternetSetOptionA = {((f4 46 9f 39) | (39 9f 46 f4))}
		$GetClipboardData = {((fe 1c 95 10) | (10 95 1c fe))}
		$HttpSendRequestExA = {((b5 af 08 d3) | (d3 08 af b5))}
		$CreateProcessA = {((9d d8 4b c2) | (c2 4b d8 9d))}
		$CreateToolhelp32Snapshot = {((84 c6 8c e5) | (e5 8c c6 84))}
		$GetProcessHeap = {((90 ab e6 70) | (70 e6 ab 90))}
		$MapVirtualKeyExA = {((e1 80 19 ba) | (ba 19 80 e1))}
		$NtTerminateProcess = {((a3 79 67 d7) | (d7 67 79 a3))}
		$CallNextHookEx = {((e8 10 af 55) | (55 af 10 e8))}
		$TerminateProcess = {((af e5 51 5a) | (5a 51 e5 af))}
		$GetIpNetTable = {((d6 7e d2 76) | (76 d2 7e d6))}
		$SetThreadToken = {((9a c7 1f 5d) | (5d 1f c7 9a))}
		$SetCurrentDirectory = {((f4 f5 08 9f) | (9f 08 f5 f4))}
		$GetFileTime = {((b5 ba 81 17) | (17 81 ba b5))}
		$CreateRemoteThread = {((d4 63 27 23) | (23 27 63 d4))}
		$KeInsertQueueApc = {((ac 32 45 07) | (07 45 32 ac))}
		$SetWindowsHookExA = {((dd 6d 6f 7f) | (7f 6f 6d dd))}
		$EnumWindows = {((b4 cf ad 00) | (00 ad cf b4))}
		$NtSetSystemEnvironmentValueEx = {((89 7f b7 f6) | (f6 b7 7f 89))}
		$GetKeynameTextA = {((a8 fa a2 24) | (24 a2 fa a8))}
		$CryptCreateHash = {((ed 73 fd 4d) | (4d fd 73 ed))}
		$CreateThread = {((f5 6b 98 41) | (41 98 6b f5))}
		$GetCurrentThread = {((98 fa cd f5) | (f5 cd fa 98))}
		$EnumResourceTypesExA = {((b9 ec bc 5f) | (5f bc ec b9))}
		$OpenSCManagerA = {((df 37 18 9e) | (9e 18 37 df))}
		$NtWriteVirtualMemory = {((98 88 31 55) | (55 31 88 98))}
		$WSASocketA = {((93 04 7f bb) | (bb 7f 04 93))}
		$SetWindowLongPtrA = {((f6 1f 59 29) | (29 59 1f f6))}
		$CryptAcquireContextA = {((b6 63 0f e5) | (e5 0f 63 b6))}
		$Thread32Next = {((e1 d7 bd f8) | (f8 bd d7 e1))}
		$RegisterRawInputDevices = {((c1 79 44 d5) | (d5 44 79 c1))}
		$Gethostbyname = {((e5 1c e4 1d) | (1d e4 1c e5))}
		$GetLogicalProcessorInformationEx = {((e5 70 81 25) | (25 81 70 e5))}
		$CreateWindowExA = {((87 03 85 69) | (69 85 03 87))}
		$GetTickCount64 = {((d3 26 cf 9f) | (9f cf 26 d3))}
		$SendMessageCallbackA = {((b1 41 54 55) | (55 54 41 b1))}
		$WNetAddConnection2A = {((bd 25 2b 91) | (91 2b 25 bd))}
		$ShellExecuteA = {((e2 d4 15 47) | (47 15 d4 e2))}
		$CryptGenRandom = {((ea 61 4d b6) | (b6 4d 61 ea))}
		$RegConnectRegistryA = {((d1 12 87 5f) | (5f 87 12 d1))}
		$CryptBinaryToString = {((f5 1b 77 09) | (09 77 1b f5))}
		$RtlMoveMemory = {((b7 74 86 ab) | (ab 86 74 b7))}
		$CopyFile2 = {((ff cf ba 64) | (64 ba cf ff))}
		$TimeGetTime = {((fb 24 cb 96) | (96 cb 24 fb))}
		$Thread32First = {((c0 36 90 bb) | (bb 90 36 c0))}
		$PostMessageA = {((91 64 bf b0) | (b0 bf 64 91))}
		$WSACleanup = {((98 9a da 76) | (76 da 9a 98))}
		$NtShutdownSystem = {((a9 f2 f7 01) | (01 f7 f2 a9))}
		$GetModuleFileNameA = {((ff b8 09 4c) | (4c 09 b8 ff))}
		$Socket = {((b6 76 2b 0f) | (0f 2b 76 b6))}
		$NtCreateUserProcess = {((e6 37 9d 00) | (00 9d 37 e6))}
		$GetCurrentProcessId = {((ac c5 52 dd) | (dd 52 c5 ac))}
		$InternetCloseHandle = {((90 3e ac 35) | (35 ac 3e 90))}
		$OpenFileMappingA = {((de 0f 45 87) | (87 45 0f de))}
		$NtQueryDirectoryFile = {((f9 35 18 f8) | (f8 18 35 f9))}
		$GetAdaptersInfo = {((86 02 a3 98) | (98 a3 02 86))}
		$MapViewOfFile = {((f5 8c 23 1a) | (1a 23 8c f5))}
		$TerminateThread = {((b9 6d 6b 19) | (19 6b 6d b9))}
		$ControlServiceExA = {((cd a4 98 19) | (19 98 a4 cd))}
		$CreateProcessInternal = {((9f 98 e3 2f) | (2f e3 98 9f))}
		$CreateMutexA = {((c6 f5 5e c8) | (c8 5e f5 c6))}
		$WSAIoctl = {((e3 54 d6 83) | (83 d6 54 e3))}
		$RegOpenKeyTransactedA = {((e4 75 6e 2f) | (2f 6e 75 e4))}
		$Connect = {((db 17 fe 90) | (90 fe 17 db))}
		$RegQueryInfoKeyA = {((98 27 6c 5c) | (5c 6c 27 98))}
		$RegSetKeySecurity = {((bb f0 80 c1) | (c1 80 f0 bb))}
		$NtClose = {((9d d9 44 72) | (72 44 d9 9d))}
		$Sleep = {((e4 c3 e4 1a) | (1a e4 c3 e4))}
		$NtProtectVirtualMemory = {((86 19 8e 2c) | (2c 8e 19 86))}
		$NtReadVirtualMemory = {((c9 92 43 20) | (20 43 92 c9))}
		$Gethostname = {((97 97 31 81) | (81 31 97 97))}
		$CopyFileExA = {((aa 63 66 e1) | (e1 66 63 aa))}
		$Wow64SetThreadContext = {((a7 66 c6 47) | (47 c6 66 a7))}
		$EnumProcessModulesEx = {((ff b9 0e 38) | (38 0e b9 ff))}
		$GetSystemDirectoryA = {((90 2a 9c b8) | (b8 9c 2a 90))}
		$NtCreateProcess = {((d5 b6 08 b7) | (b7 08 b6 d5))}
		$SetThreadContext = {((f1 fe 62 f0) | (f0 62 fe f1))}
		$DnsQueryEx = {((e2 18 52 5f) | (5f 52 18 e2))}
		$LoadResource = {((d0 f8 73 ac) | (ac 73 f8 d0))}
		$NtAllocateVirtualMemory = {((9f 48 6d 19) | (19 6d 48 9f))}
		$ConnectNamedPipe = {((b5 43 62 cf) | (cf 62 43 b5))}
		$RegDeleteKeyValueA = {((d2 3a 53 40) | (40 53 3a d2))}
		$CreatePipe = {((a4 68 3f 72) | (72 3f 68 a4))}
		$NtDelayExecution = {((a0 49 20 bb) | (bb 20 49 a0))}
		$RtlGetVersion = {((83 8d d9 b4) | (b4 d9 8d 83))}
		$NtOpenThread = {((b4 97 34 31) | (31 34 97 b4))}
		$RegReplaceKeyA = {((ee a7 8c 03) | (03 8c a7 ee))}
		$RtlCreateHeap = {((b8 a0 f3 3d) | (3d f3 a0 b8))}
		$CheckRemoteDebuggerPresent = {((d7 e9 fb f0) | (f0 fb e9 d7))}
		$GetProcessIdOfThread = {((d6 db 03 72) | (72 03 db d6))}
		$SetForegroundWindow = {((fa 49 6a 3e) | (3e 6a 49 fa))}
		$SetWinEventHook = {((9b a7 c6 eb) | (eb c6 a7 9b))}
		$RegisterHotKey = {((cd 79 09 42) | (42 09 79 cd))}
		$NtQueryInformationProcess = {((bd 78 10 24) | (24 10 78 bd))}
		$CreateRemoteThreadEx = {((ac a7 e6 78) | (78 e6 a7 ac))}
		$OpenClipboard = {((a8 e8 ca 09) | (09 ca e8 a8))}
		$RegEnumValueA = {((b6 86 91 75) | (75 91 86 b6))}
		$URLDownloadToCacheFile = {((c7 a7 15 82) | (82 15 a7 c7))}
		$LocalAlloc = {((8c 16 9f e5) | (e5 9f 16 8c))}
		$ShowWindow = {((d6 b0 35 48) | (48 35 b0 d6))}
		$VirtualQueryEx = {((ad 9b c4 28) | (28 c4 9b ad))}
		$NtQueueApcThread = {((d8 64 97 18) | (18 97 64 d8))}
		$NtMakeTemporaryObject = {((c5 98 d2 0d) | (0d d2 98 c5))}
		$VirtualAllocExNuma = {((96 3d 26 35) | (35 26 3d 96))}
		$RegOpenKeyA = {((de 33 44 c1) | (c1 44 33 de))}
		$EnumDesktopWindows = {((9d 7f 47 e7) | (e7 47 7f 9d))}
		$WaitForSingleObject = {((b1 fd 6d fb) | (fb 6d fd b1))}
		$FindResourceExA = {((e9 7a da 53) | (53 da 7a e9))}
		$CryptStringToBinary = {((b4 5c 62 90) | (90 62 5c b4))}
		$RegEnumKeyA = {((99 41 6e 8d) | (8d 6e 41 99))}
		$Select = {((ac 1e 53 c5) | (c5 53 1e ac))}
		$WNetEnumResourceA = {((c7 ca d1 a2) | (a2 d1 ca c7))}
		$EnumProcesses = {((af b2 ae 78) | (78 ae b2 af))}
		$Listen = {((cc e1 04 1e) | (1e 04 e1 cc))}
		$RegCreateKeyA = {((9c 1d 2c 0c) | (0c 2c 1d 9c))}
		$IsDebuggerPresent = {((96 48 8b d7) | (d7 8b 48 96))}
		$FindNextUrlCacheEntryA = {((81 6f 03 09) | (09 03 6f 81))}
		$StartServiceA = {((f9 85 0c d6) | (d6 0c 85 f9))}
		$GetThreadContext = {((ef 5b 27 af) | (af 27 5b ef))}
		$VirtualAlloc = {((e7 63 fd f1) | (f1 fd 63 e7))}
		$Module32First = {((f9 c1 ee f8) | (f8 ee c1 f9))}
		$FindFirstUrlCacheEntryA = {((d8 09 db 7f) | (7f db 09 d8))}
		$SleepEx = {((f1 8c f8 d7) | (d7 f8 8c f1))}
		$MoveFileA = {((cc 32 64 6c) | (6c 64 32 cc))}
		$NtSetValueKey = {((b0 3e 05 9a) | (9a 05 3e b0))}
		$SetWindowLongA = {((ff 6b 93 b9) | (b9 93 6b ff))}
		$MapViewOfFileEx = {((aa 57 81 43) | (43 81 57 aa))}
		$NtDuplicateObject = {((d1 bd 6a 37) | (37 6a bd d1))}
		$GetKeyboardState = {((d2 d4 74 13) | (13 74 d4 d2))}
		$GetSystemTime = {((bd 78 fe eb) | (eb fe 78 bd))}
		$FindWindowExA = {((a4 64 ab 96) | (96 ab 64 a4))}
		$RegQueryMultipleValuesA = {((ec 6c aa 81) | (81 aa 6c ec))}
		$DrawTextExA = {((ea 68 29 ca) | (ca 29 68 ea))}
		$RegEnumKeyExA = {((81 a3 d1 95) | (95 d1 a3 81))}
		$QueueUserAPC = {((92 e7 ae 6f) | (6f ae e7 92))}
		$RegSaveKeyA = {((81 9d 99 4e) | (4e 99 9d 81))}
		$CreateFileMappingA = {((b0 4c c8 3c) | (3c c8 4c b0))}
		$CryptDestroyKey = {((fa 39 e0 e6) | (e6 e0 39 fa))}
		$RegDeleteKeyExA = {((f9 a7 1b eb) | (eb 1b a7 f9))}
		$EnumResourceTypesA = {((84 c0 e3 58) | (58 e3 c0 84))}
		$RegSetKeyValueA = {((a3 23 09 39) | (39 09 23 a3))}
		$timeSetEvent = {((93 11 60 50) | (50 60 11 93))}
		$RegSaveKeyExA = {((d2 4f ec 1e) | (1e ec 4f d2))}
		$CountClipboardFormats = {((8d df f2 80) | (80 f2 df 8d))}
		$HttpAddRequestHeaders = {((bd cf 08 17) | (17 08 cf bd))}
		$NtQueueApcThreadEx2 = {((a9 5e 88 2f) | (2f 88 5e a9))}
		$RegCopyTreeA = {((e7 a5 fe 8b) | (8b fe a5 e7))}
		$ImpersonateLoggedOnUser = {((8a aa f0 c2) | (c2 f0 aa 8a))}
		$GetDriveTypeA = {((ea 52 a4 8f) | (8f a4 52 ea))}
		$GetVersionExA = {((bb 37 29 89) | (89 29 37 bb))}
		$InternetReadFile = {((f9 06 15 aa) | (aa 15 06 f9))}
		$RegOpenCurrentUser = {((d5 81 7a 6d) | (6d 7a 81 d5))}
		$GetThreadLocale = {((bc f0 3e df) | (df 3e f0 bc))}
		$NtUnmapViewOfSection = {((ce da c5 6a) | (6a c5 da ce))}
		$FindNextFileA = {((e7 c0 95 1a) | (1a 95 c0 e7))}
		$GetLogicalProcessorInformation = {((99 75 ba 55) | (55 ba 75 99))}
		$FlushEfsCache = {((99 73 35 b6) | (b6 35 73 99))}
		$Closesocket = {((96 b1 c8 ac) | (ac c8 b1 96))}
		$NetShareGetInfo = {((de a5 c7 4a) | (4a c7 a5 de))}
		$GetModuleHandleA = {((ff 44 9b d2) | (d2 9b 44 ff))}
		$VirtualAlloc2FromApp = {((ef 9d d5 6f) | (6f d5 9d ef))}
		$MoveFileExA = {((89 b5 4f ae) | (ae 4f b5 89))}
		$NtWaitForMultipleObjects = {((b9 5f 31 82) | (82 31 5f b9))}
		$DeleteFileA = {((ea ce fa 88) | (88 fa ce ea))}
		$StartServiceCtrlDispatcherA = {((98 80 1d 8f) | (8f 1d 80 98))}
		$HttpOpenRequestA = {((9e 88 88 22) | (22 88 88 9e))}
		$GetThreadInformation = {((ed ed 02 c3) | (c3 02 ed ed))}
		$NtDeleteKey = {((b9 9d 43 d3) | (d3 43 9d b9))}
		$InternetWriteFile = {((89 bc 0e 62) | (62 0e bc 89))}
		$LoadLibraryA = {((a7 ac 18 d1) | (d1 18 ac a7))}
		$RegQueryValueExA = {((9e 7b 25 96) | (96 25 7b 9e))}
		$NtCreateProcessEx = {((aa 0d aa df) | (df aa 0d aa))}
		$GetForegroundWindow = {((96 4d 7d fe) | (fe 7d 4d 96))}
		$NtQuerySystemEnvironmentValueEx = {((d3 5c a8 e2) | (e2 a8 5c d3))}
		$SizeOfResource = {((e0 84 77 0d) | (0d 77 84 e0))}
		$RegGetValueA = {((aa f2 83 43) | (43 83 f2 aa))}
		$LdrLoadDll = {((de b5 44 45) | (45 44 b5 de))}
		$NtResumeThread = {((ac 7e a5 b4) | (b4 a5 7e ac))}
		$MapViewOfFile3 = {((b4 ed 86 e5) | (e5 86 ed b4))}
		$NtQueryTimer = {((a2 5e 29 f0) | (f0 29 5e a2))}
		$RtlCopyMemory = {((96 ca e3 37) | (37 e3 ca 96))}
		$InternetConnectA = {((fb 9e 0a fa) | (fa 0a 9e fb))}
		$SetClipboardData = {((e0 b9 d0 4f) | (4f d0 b9 e0))}
		$GetKeyState = {((8d ab b0 a8) | (a8 b0 ab 8d))}
		$WriteProcessMemory = {((b2 12 8a bf) | (bf 8a 12 b2))}
		$RtlSetProcessIsCritical = {((ad d9 bb cc) | (cc bb d9 ad))}
		$NetShareAdd = {((b1 9f 7c 47) | (47 7c 9f b1))}
		$NtResumeProcess = {((f5 fb e4 bf) | (bf e4 fb f5))}
		$GetProcessHeaps = {((8f 41 b1 dd) | (dd b1 41 8f))}
		$RegDeleteKeyTransactedA = {((bb 83 41 f5) | (f5 41 83 bb))}
		$ReadProcessMemory = {((f4 5f 62 31) | (31 62 5f f4))}
		$GetNativeSystemInfo = {((b6 b1 64 d9) | (d9 64 b1 b6))}
		$ioctlsocket = {((84 e2 3d 81) | (81 3d e2 84))}
		$CreateProcessAsUserA = {((e0 fe 02 df) | (df 02 fe e0))}
		$PeekNamedPipe = {((d9 8c cd 01) | (01 cd 8c d9))}
		$SuspendThread = {((ee b3 ac 52) | (52 ac b3 ee))}
		$CallWindowProcA = {((e7 72 d4 97) | (97 d4 72 e7))}
		$OpenServiceA = {((bd 6b d2 08) | (08 d2 6b bd))}
		$SetTimer = {((e9 18 cf 58) | (58 cf 18 e9))}
		$MapViewOfFile2 = {((90 b1 4d 76) | (76 4d b1 90))}
		$RegRestoreKeyA = {((d9 2e 33 9c) | (9c 33 2e d9))}
		$InternetOpenUrlA = {((e2 e5 9b 7e) | (7e 9b e5 e2))}
		$GetTempPathA = {((ed 02 a0 63) | (63 a0 02 ed))}
		$NtAdjustPrivilegesToken = {((a9 b5 8d 44) | (44 8d b5 a9))}
		$GetTickCount = {((cd 39 9c 92) | (92 9c 39 cd))}
		$RegSetValueExA = {((fe d1 8e 22) | (22 8e d1 fe))}
		$NtCreateSection = {((8c 8f 2c 8c) | (8c 2c 8f 8c))}
		$SetPropA = {((88 fc 6b ce) | (ce 6b fc 88))}
		$GetModuleFileNameExA = {((ca 39 ac 7b) | (7b ac 39 ca))}
		$PathFileExistsA = {((e9 a2 e4 1b) | (1b e4 a2 e9))}
		$SetFocus = {((c4 2f 26 c9) | (c9 26 2f c4))}
		$GetDCEx = {((98 08 aa b3) | (b3 aa 08 98))}
		$WNetOpenEnumA = {((ec ec 57 f8) | (f8 57 ec ec))}
		$FindFirstFileA = {((af f4 3d 53) | (53 3d f4 af))}
		$AttachThreadInput = {((f3 c6 46 a6) | (a6 46 c6 f3))}
		$AdjustTokenPrivileges = {((ce 5f 66 f0) | (f0 66 5f ce))}
		$EnumProcessModules = {((d9 bf 5a dd) | (dd 5a bf d9))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2683dd1f-4368-423a-a6cc-c318a49bbf5e
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
