api_hashes_mamon_hash

YARA detection rule by filescanio
Rule api_hashes_mamon_hash (No description metadata provided).
import "math"
import "pe"
rule api_hashes_mamon_hash : hardened
{
	strings:
		$ControlService = {((5e 7e 54 14) | (14 54 7e 5e))}
		$HttpSendRequestA = {((af b1 da f6) | (f6 da b1 af))}
		$SetThreadPriority = {((06 f5 ee 88) | (88 ee f5 06))}
		$Recv = {((04 d9 03 32) | (32 03 d9 04))}
		$QueryPerformanceFrequency = {((a3 63 1a 5c) | (5c 1a 63 a3))}
		$RegDeleteValueA = {((46 31 2f f1) | (f1 2f 31 46))}
		$GetWindowsDirectoryA = {((d5 47 85 83) | (83 85 47 d5))}
		$CryptSetKeyParam = {((00 d9 53 3a) | (3a 53 d9 00))}
		$RegCreateKeyExA = {((d3 5d 45 3b) | (3b 45 5d d3))}
		$Module32Next = {((59 12 a2 6c) | (6c a2 12 59))}
		$RegOpenUserClassesRoot = {((bc fa 38 e3) | (e3 38 fa bc))}
		$NtReadVirtualMemoryEx = {((84 d3 44 5d) | (5d 44 d3 84))}
		$InternetOpenA = {((ce 40 f6 fe) | (fe f6 40 ce))}
		$URLOpenBlockingStream = {((5e 71 08 1c) | (1c 08 71 5e))}
		$NtSetInformationThread = {((a2 e2 2d 2e) | (2e 2d e2 a2))}
		$CreateFileA = {((9e eb 11 17) | (17 11 eb 9e))}
		$UnhookWindowsHookEx = {((b3 97 91 af) | (af 91 97 b3))}
		$GetCurrentThreadId = {((0c 45 4b 0a) | (0a 4b 45 0c))}
		$Accept = {((77 5a 7a 92) | (92 7a 5a 77))}
		$HeapReAlloc = {((d1 86 0c 42) | (42 0c 86 d1))}
		$WinExec = {((0e df 9b 15) | (15 9b df 0e))}
		$NtQueueApcThreadEx = {((aa d9 a2 12) | (12 a2 d9 aa))}
		$VirtualAllocFromApp = {((91 f0 14 e9) | (e9 14 f0 91))}
		$RegLoadKeyA = {((3a 39 3b 0a) | (0a 3b 39 3a))}
		$OutputDebugStringA = {((b3 19 a8 12) | (12 a8 19 b3))}
		$GetFileAttributesA = {((06 43 75 4a) | (4a 75 43 06))}
		$SetWaitableTimer = {((22 b3 21 38) | (38 21 b3 22))}
		$SendMessageA = {((b3 41 f3 32) | (32 f3 41 b3))}
		$RegUnLoadKeyA = {((7d d7 c9 6d) | (6d c9 d7 7d))}
		$SetEnvironmentVariableA = {((10 ec e6 aa) | (aa e6 ec 10))}
		$VirtualAlloc2 = {((17 41 89 06) | (06 89 41 17))}
		$CryptProtectData = {((04 93 3c 8f) | (8f 3c 93 04))}
		$GetDesktopWindow = {((3a 88 9e 34) | (34 9e 88 3a))}
		$RegGetKeySecurity = {((7c 75 53 e1) | (e1 53 75 7c))}
		$GetDC = {((9f 32 9e 09) | (09 9e 32 9f))}
		$LookupPrivilegeValueA = {((ec 9d 01 e1) | (e1 01 9d ec))}
		$CryptGetHashParam = {((2b 00 6a 29) | (29 6a 00 2b))}
		$HeapAlloc = {((38 9a 46 eb) | (eb 46 9a 38))}
		$RegCloseKey = {((26 bf 82 1f) | (1f 82 bf 26))}
		$CryptHashData = {((1f b9 5a f2) | (f2 5a b9 1f))}
		$GlobalAlloc = {((6e a5 84 5e) | (5e 84 a5 6e))}
		$RegOverridePredefKey = {((a2 90 1f 5f) | (5f 1f 90 a2))}
		$EnumSystemLocalesA = {((bf e5 d7 00) | (00 d7 e5 bf))}
		$GetProcessId = {((67 64 76 ae) | (ae 76 64 67))}
		$RegLoadMUIStringA = {((e3 2f 0f c3) | (c3 0f 2f e3))}
		$SearchPathA = {((89 ac 8a e6) | (e6 8a ac 89))}
		$FindClose = {((cd 84 24 f9) | (f9 24 84 cd))}
		$NtDeleteValueKey = {((39 c4 67 3d) | (3d 67 c4 39))}
		$URLDownloadToFile = {((55 90 08 30) | (30 08 90 55))}
		$Toolhelp32ReadProcessMemory = {((7c 95 fe e2) | (e2 fe 95 7c))}
		$GetProcAddress = {((db 36 0d 1c) | (1c 0d 36 db))}
		$OpenProcessToken = {((e3 dc 95 d4) | (d4 95 dc e3))}
		$HeapCreate = {((50 f5 f8 f4) | (f4 f8 f5 50))}
		$UuidFromStringA = {((87 de 39 65) | (65 39 de 87))}
		$VirtualProtectEx = {((f6 73 57 67) | (67 57 73 f6))}
		$GetSystemTimeAsFileTime = {((72 9f e6 d9) | (d9 e6 9f 72))}
		$GetModuleBaseNameA = {((34 36 e8 05) | (05 e8 36 34))}
		$lstrcatA = {((5f 21 83 a0) | (a0 83 21 5f))}
		$SetFileAttributesA = {((2f 4d 0e d6) | (d6 0e 4d 2f))}
		$FindResourceA = {((16 03 d4 8c) | (8c d4 03 16))}
		$WaitForMultipleObjects = {((bc 61 76 f4) | (f4 76 61 bc))}
		$QueryPerformanceCounter = {((02 2e f3 aa) | (aa f3 2e 02))}
		$NtCreateThreadEx = {((e9 6c e6 6d) | (6d e6 6c e9))}
		$NtContinue = {((a4 43 3c a9) | (a9 3c 43 a4))}
		$IsWoW64Process = {((2a b9 73 44) | (44 73 b9 2a))}
		$DnsQuery_A = {((17 3d 7e fd) | (fd 7e 3d 17))}
		$VirtualProtectFromApp = {((1e 75 e1 5f) | (5f e1 75 1e))}
		$GetAsyncKeyState = {((2f 85 0b 4a) | (4a 0b 85 2f))}
		$EncryptFileA = {((d1 cb ae 08) | (08 ae cb d1))}
		$DuplicateToken = {((d6 10 73 7e) | (7e 73 10 d6))}
		$CryptDeriveKey = {((ae df 81 dc) | (dc 81 df ae))}
		$LockResource = {((32 38 41 53) | (53 41 38 32))}
		$ResumeThread = {((91 f3 d9 2b) | (2b d9 f3 91))}
		$WaitForSingleObjectEx = {((87 ab 94 f4) | (f4 94 ab 87))}
		$NtSuspendProcess = {((72 6a 83 25) | (25 83 6a 72))}
		$NetShareCheck = {((92 75 9a 5a) | (5a 9a 75 92))}
		$OpenThread = {((ac a5 93 0c) | (0c 93 a5 ac))}
		$URLOpenStream = {((2f d9 91 73) | (73 91 d9 2f))}
		$UnmapViewOfFile = {((62 c8 83 f3) | (f3 83 c8 62))}
		$CreateFile2 = {((9e eb 11 08) | (08 11 eb 9e))}
		$DeleteService = {((6e 81 47 c6) | (c6 47 81 6e))}
		$GetThreadId = {((d8 8b fd 47) | (47 fd 8b d8))}
		$RegDeleteKeyA = {((d3 9c 86 3d) | (3d 86 9c d3))}
		$CreateTimerQueueTimer = {((42 61 29 fd) | (fd 29 61 42))}
		$SetProcessDEPPolicy = {((d4 7d 89 16) | (16 89 7d d4))}
		$CreateServiceA = {((9f 23 20 08) | (08 20 23 9f))}
		$ExitWindowsEx = {((a7 40 d0 64) | (64 d0 40 a7))}
		$NtMapViewOfSection = {((5c c6 21 e7) | (e7 21 c6 5c))}
		$NtTerminateThread = {((96 b6 0a a5) | (a5 0a b6 96))}
		$Process32First = {((9e 7d 0a 6e) | (6e 0a 7d 9e))}
		$RegCreateKeyTransactedA = {((8d 75 a1 67) | (67 a1 75 8d))}
		$GetUserNameA = {((b9 a1 5a 03) | (03 5a a1 b9))}
		$MapVirtualKeyA = {((e3 5f a5 d1) | (d1 a5 5f e3))}
		$WNetCloseEnum = {((38 c3 2e 2b) | (2b 2e c3 38))}
		$InternetReadFileExA = {((29 b3 53 c5) | (c5 53 b3 29))}
		$GetComputerNameA = {((c8 c4 84 f3) | (f3 84 c4 c8))}
		$RegFlushKey = {((f9 85 99 ab) | (ab 99 85 f9))}
		$VirtualAllocEx = {((ff 72 ac b1) | (b1 ac 72 ff))}
		$GetSystemDefaultLangId = {((7e db 42 1b) | (1b 42 db 7e))}
		$SetFileTime = {((6c 3f 19 fd) | (fd 19 3f 6c))}
		$SendNotifyMessageA = {((47 69 86 6b) | (6b 86 69 47))}
		$LookupAccountNameA = {((7f cb 88 eb) | (eb 88 cb 7f))}
		$NetShareEnum = {((ce 23 cc 71) | (71 cc 23 ce))}
		$IcmpSendEcho = {((ad 93 f5 54) | (54 f5 93 ad))}
		$DebugActiveProcessStop = {((d1 38 be 8a) | (8a be 38 d1))}
		$NtCreateFile = {((33 83 9b 98) | (98 9b 83 33))}
		$DecryptFileA = {((f0 95 f1 5e) | (5e f1 95 f0))}
		$GetRawInputData = {((5f 6e 34 b6) | (b6 34 6e 5f))}
		$BringWindowToTop = {((a0 12 9f a2) | (a2 9f 12 a0))}
		$NetShareSetInfo = {((cf eb 33 14) | (14 33 eb cf))}
		$GetLogicalDrives = {((4f 1d 3c 4a) | (4a 3c 1d 4f))}
		$WriteFile = {((7e d9 cc 8d) | (8d cc d9 7e))}
		$BitBlt = {((7a 24 f3 43) | (43 f3 24 7a))}
		$SendMessageTimeoutA = {((23 38 b5 39) | (39 b5 38 23))}
		$GetCurrentProcess = {((b5 06 e2 04) | (04 e2 06 b5))}
		$RegDeleteTreeA = {((47 d6 fb 24) | (24 fb d6 47))}
		$CreateProcessWithTokenW = {((bb c8 4c e9) | (e9 4c c8 bb))}
		$FindWindowA = {((3b 94 74 5c) | (5c 74 94 3b))}
		$CopyFileA = {((c4 bf 33 9e) | (9e 33 bf c4))}
		$FtpPutFileA = {((f8 07 a9 66) | (66 a9 07 f8))}
		$NtOpenProcess = {((29 97 46 b5) | (b5 46 97 29))}
		$Send = {((04 d9 90 ec) | (ec 90 d9 04))}
		$EnumDeviceDrivers = {((5b c1 89 c6) | (c6 89 c1 5b))}
		$Process32Next = {((69 ab 05 85) | (85 05 ab 69))}
		$GetWindowDC = {((e0 ec fb 01) | (01 fb ec e0))}
		$CryptDecrypt = {((fc 10 53 0f) | (0f 53 10 fc))}
		$ReadFile = {((fd 63 71 5e) | (5e 71 63 fd))}
		$VirtualProtect = {((90 54 43 8a) | (8a 43 54 90))}
		$OpenProcess = {((24 8b 48 f3) | (f3 48 8b 24))}
		$WaitForMultipleObjectsEx = {((5a 9b 0d 51) | (51 0d 9b 5a))}
		$Inet_addr = {((3a bd 7c ec) | (ec 7c bd 3a))}
		$WSAStartup = {((8d 61 a2 00) | (00 a2 61 8d))}
		$Bind = {((04 d0 4f 7f) | (7f 4f d0 04))}
		$GetTempFileNameA = {((97 6a 34 fa) | (fa 34 6a 97))}
		$CreateMutexExA = {((e8 ba 5c 07) | (07 5c ba e8))}
		$DeviceIoControl = {((92 22 d2 6b) | (6b d2 22 92))}
		$CryptDestroyHash = {((66 b2 cc 22) | (22 cc b2 66))}
		$CryptEncrypt = {((5e 08 fd 79) | (79 fd 08 5e))}
		$NtSetContextThread = {((6a 32 e9 4d) | (4d e9 32 6a))}
		$CryptReleaseContext = {((7f 5b 4b 1a) | (1a 4b 5b 7f))}
		$StretchBlt = {((23 91 d2 a1) | (a1 d2 91 23))}
		$NtWaitForSingleObject = {((7d 5c 59 99) | (99 59 5c 7d))}
		$LoadLibraryExA = {((5b 84 8e 75) | (75 8e 84 5b))}
		$PeekMessageA = {((2b 6f d7 ed) | (ed d7 6f 2b))}
		$WNetAddConnectionA = {((c0 bc f9 5a) | (5a f9 bc c0))}
		$NtCreateThread = {((43 72 59 10) | (10 59 72 43))}
		$ShellExecuteExA = {((27 7e 34 8b) | (8b 34 7e 27))}
		$GetMessageA = {((7f 23 04 c8) | (c8 04 23 7f))}
		$GetCurrentHwProfileA = {((7e 64 fc 36) | (36 fc 64 7e))}
		$PostThreadMessageA = {((c9 4e fa 46) | (46 fa 4e c9))}
		$RegOpenKeyExA = {((e0 de 1d b9) | (b9 1d de e0))}
		$CreateWaitableTimer = {((ea ef 12 40) | (40 12 ef ea))}
		$NtSetInformationProcess = {((e2 5b 27 55) | (55 27 5b e2))}
		$InternetSetOptionA = {((e6 39 97 71) | (71 97 39 e6))}
		$GetClipboardData = {((ab 87 1c 6c) | (6c 1c 87 ab))}
		$HttpSendRequestExA = {((63 94 91 33) | (33 91 94 63))}
		$CreateProcessA = {((ba b9 80 16) | (16 80 b9 ba))}
		$CreateToolhelp32Snapshot = {((69 81 c4 d2) | (d2 c4 81 69))}
		$GetProcessHeap = {((d2 5c 5e ff) | (ff 5e 5c d2))}
		$MapVirtualKeyExA = {((39 e0 7e ce) | (ce 7e e0 39))}
		$NtTerminateProcess = {((50 aa b3 ac) | (ac b3 aa 50))}
		$CallNextHookEx = {((17 9e b1 4b) | (4b b1 9e 17))}
		$TerminateProcess = {((7f 0f cc aa) | (aa cc 0f 7f))}
		$GetIpNetTable = {((94 eb 71 ca) | (ca 71 eb 94))}
		$SetThreadToken = {((63 5f 69 c7) | (c7 69 5f 63))}
		$SetCurrentDirectory = {((83 d3 d7 26) | (26 d7 d3 83))}
		$GetFileTime = {((2b e6 9a f1) | (f1 9a e6 2b))}
		$CreateRemoteThread = {((e3 d7 7f da) | (da 7f d7 e3))}
		$KeInsertQueueApc = {((ee 5a 58 80) | (80 58 5a ee))}
		$SetWindowsHookExA = {((56 a8 74 68) | (68 74 a8 56))}
		$EnumWindows = {((48 24 27 e2) | (e2 27 24 48))}
		$NtSetSystemEnvironmentValueEx = {((ab 64 86 64) | (64 86 64 ab))}
		$GetKeynameTextA = {((ee 81 4d d2) | (d2 4d 81 ee))}
		$CryptCreateHash = {((05 41 2c 0c) | (0c 2c 41 05))}
		$CreateThread = {((9c e6 a3 0e) | (0e a3 e6 9c))}
		$GetCurrentThread = {((fe 99 cd fd) | (fd cd 99 fe))}
		$EnumResourceTypesExA = {((d9 1d aa f2) | (f2 aa 1d d9))}
		$OpenSCManagerA = {((c6 f3 99 86) | (86 99 f3 c6))}
		$NtWriteVirtualMemory = {((d5 7e c3 4f) | (4f c3 7e d5))}
		$WSASocketA = {((81 d7 f1 17) | (17 f1 d7 81))}
		$SetWindowLongPtrA = {((0f cc 53 cd) | (cd 53 cc 0f))}
		$CryptAcquireContextA = {((df 72 10 04) | (04 10 72 df))}
		$Thread32Next = {((87 2f b8 9e) | (9e b8 2f 87))}
		$RegisterRawInputDevices = {((21 fd 71 a4) | (a4 71 fd 21))}
		$Gethostbyname = {((1e 8b b3 bc) | (bc b3 8b 1e))}
		$GetLogicalProcessorInformationEx = {((67 00 fb 00) | (00 fb 00 67))}
		$CreateWindowExA = {((a9 11 74 0c) | (0c 74 11 a9))}
		$GetTickCount64 = {((6d 52 02 20) | (20 02 52 6d))}
		$SendMessageCallbackA = {((2e 60 9b 1f) | (1f 9b 60 2e))}
		$WNetAddConnection2A = {((d8 5c 22 ec) | (ec 22 5c d8))}
		$ShellExecuteA = {((11 aa c8 4e) | (4e c8 aa 11))}
		$CryptGenRandom = {((a1 4e 93 cf) | (cf 93 4e a1))}
		$RegConnectRegistryA = {((0e 40 04 44) | (44 04 40 0e))}
		$CryptBinaryToString = {((9e a4 6c 93) | (93 6c a4 9e))}
		$RtlMoveMemory = {((dd 95 fc 64) | (64 fc 95 dd))}
		$CopyFile2 = {((c4 bf 33 8f) | (8f 33 bf c4))}
		$TimeGetTime = {((25 d7 05 80) | (80 05 d7 25))}
		$Thread32First = {((6c 98 20 a7) | (a7 20 98 6c))}
		$PostMessageA = {((b2 02 d5 4e) | (4e d5 02 b2))}
		$WSACleanup = {((ab 53 86 f5) | (f5 86 53 ab))}
		$NtShutdownSystem = {((99 06 70 25) | (25 70 06 99))}
		$GetModuleFileNameA = {((4d 5f a9 ca) | (ca a9 5f 4d))}
		$Socket = {((a2 30 94 0b) | (0b 94 30 a2))}
		$NtCreateUserProcess = {((ce 16 5d 76) | (76 5d 16 ce))}
		$GetCurrentProcessId = {((12 47 7c d1) | (d1 7c 47 12))}
		$InternetCloseHandle = {((b0 c9 d7 0d) | (0d d7 c9 b0))}
		$OpenFileMappingA = {((92 25 7b 81) | (81 7b 25 92))}
		$NtQueryDirectoryFile = {((e8 90 5b 2f) | (2f 5b 90 e8))}
		$GetAdaptersInfo = {((49 23 a1 62) | (62 a1 23 49))}
		$MapViewOfFile = {((eb 72 37 10) | (10 37 72 eb))}
		$TerminateThread = {((14 3c fb e3) | (e3 fb 3c 14))}
		$ControlServiceExA = {((e3 da 00 d2) | (d2 00 da e3))}
		$CreateProcessInternal = {((14 41 05 32) | (32 05 41 14))}
		$CreateMutexA = {((8d 7e e0 ca) | (ca e0 7e 8d))}
		$WSAIoctl = {((e4 9d 0d 88) | (88 0d 9d e4))}
		$RegOpenKeyTransactedA = {((6f 8e 17 e5) | (e5 17 8e 6f))}
		$Connect = {((19 67 fa 4c) | (4c fa 67 19))}
		$RegQueryInfoKeyA = {((64 da 9c 4c) | (4c 9c da 64))}
		$RegSetKeySecurity = {((43 78 07 6d) | (6d 07 78 43))}
		$NtClose = {((70 c7 57 da) | (da 57 c7 70))}
		$Sleep = {((a0 0f 5f 5b) | (5b 5f 0f a0))}
		$NtProtectVirtualMemory = {((56 ea 61 c5) | (c5 61 ea 56))}
		$NtReadVirtualMemory = {((30 c8 7b 00) | (00 7b c8 30))}
		$Gethostname = {((6b f3 f9 21) | (21 f9 f3 6b))}
		$CopyFileExA = {((f1 5a b3 db) | (db b3 5a f1))}
		$Wow64SetThreadContext = {((a3 99 36 12) | (12 36 99 a3))}
		$EnumProcessModulesEx = {((d7 8f f1 2c) | (2c f1 8f d7))}
		$GetSystemDirectoryA = {((54 cb dc 7d) | (7d dc cb 54))}
		$NtCreateProcess = {((94 f0 cf 77) | (77 cf f0 94))}
		$SetThreadContext = {((9c 81 5b 8b) | (8b 5b 81 9c))}
		$DnsQueryEx = {((17 3d 7b da) | (da 7b 3d 17))}
		$LoadResource = {((fa bc 08 0a) | (0a 08 bc fa))}
		$NtAllocateVirtualMemory = {((8e 74 a1 e9) | (e9 a1 74 8e))}
		$ConnectNamedPipe = {((de 64 8b 3f) | (3f 8b 64 de))}
		$RegDeleteKeyValueA = {((ce bf ca 5a) | (5a ca bf ce))}
		$CreatePipe = {((c6 c6 ca 64) | (64 ca c6 c6))}
		$NtDelayExecution = {((28 a9 cd 87) | (87 cd a9 28))}
		$RtlGetVersion = {((16 37 30 7a) | (7a 30 37 16))}
		$NtOpenThread = {((19 67 e0 8e) | (8e e0 67 19))}
		$RegReplaceKeyA = {((20 88 e7 a6) | (a6 e7 88 20))}
		$RtlCreateHeap = {((89 3e 47 e6) | (e6 47 3e 89))}
		$CheckRemoteDebuggerPresent = {((bb 55 c1 92) | (92 c1 55 bb))}
		$GetProcessIdOfThread = {((73 9f b1 fb) | (fb b1 9f 73))}
		$SetForegroundWindow = {((c3 44 4c a1) | (a1 4c 44 c3))}
		$SetWinEventHook = {((33 19 53 4f) | (4f 53 19 33))}
		$RegisterHotKey = {((8f 03 d1 9b) | (9b d1 03 8f))}
		$NtQueryInformationProcess = {((32 c7 f6 3f) | (3f f6 c7 32))}
		$CreateRemoteThreadEx = {((37 b6 e7 b7) | (b7 e7 b6 37))}
		$OpenClipboard = {((50 e1 82 84) | (84 82 e1 50))}
		$RegEnumValueA = {((5f f8 a7 73) | (73 a7 f8 5f))}
		$URLDownloadToCacheFile = {((02 c7 dd a4) | (a4 dd c7 02))}
		$LocalAlloc = {((a0 07 97 d8) | (d8 97 07 a0))}
		$ShowWindow = {((0f 5a 21 9b) | (9b 21 5a 0f))}
		$VirtualQueryEx = {((e3 98 3d 9c) | (9c 3d 98 e3))}
		$NtQueueApcThread = {((f2 c1 e7 75) | (75 e7 c1 f2))}
		$NtMakeTemporaryObject = {((a2 0a a5 fc) | (fc a5 0a a2))}
		$VirtualAllocExNuma = {((9d 98 62 e2) | (e2 62 98 9d))}
		$RegOpenKeyA = {((56 02 8d fc) | (fc 8d 02 56))}
		$EnumDesktopWindows = {((99 bc f4 3c) | (3c f4 bc 99))}
		$WaitForSingleObject = {((5b 55 b9 d7) | (d7 b9 55 5b))}
		$FindResourceExA = {((a6 4b 48 49) | (49 48 4b a6))}
		$CryptStringToBinary = {((7c 55 7e 93) | (93 7e 55 7c))}
		$RegEnumKeyA = {((a6 bc 35 3f) | (3f 35 bc a6))}
		$Select = {((a1 80 74 a2) | (a2 74 80 a1))}
		$WNetEnumResourceA = {((84 f9 60 de) | (de 60 f9 84))}
		$EnumProcesses = {((4a a5 08 4e) | (4e 08 a5 4a))}
		$Listen = {((91 78 d0 f1) | (f1 d0 78 91))}
		$RegCreateKeyA = {((10 2d ec fe) | (fe ec 2d 10))}
		$IsDebuggerPresent = {((d1 1b b5 24) | (24 b5 1b d1))}
		$FindNextUrlCacheEntryA = {((5e 8d 63 fc) | (fc 63 8d 5e))}
		$StartServiceA = {((58 6e 69 82) | (82 69 6e 58))}
		$GetThreadContext = {((0a 03 94 ff) | (ff 94 03 0a))}
		$VirtualAlloc = {((56 09 be 54) | (54 be 09 56))}
		$Module32First = {((7a d8 44 35) | (35 44 d8 7a))}
		$FindFirstUrlCacheEntryA = {((bb a0 28 45) | (45 28 a0 bb))}
		$SleepEx = {((e1 64 ab 78) | (78 ab 64 e1))}
		$MoveFileA = {((f0 d1 dd 9a) | (9a dd d1 f0))}
		$NtSetValueKey = {((ce c0 d9 b6) | (b6 d9 c0 ce))}
		$SetWindowLongA = {((9a bd 21 17) | (17 21 bd 9a))}
		$MapViewOfFileEx = {((90 dc 44 6d) | (6d 44 dc 90))}
		$NtDuplicateObject = {((0e 02 5a f6) | (f6 5a 02 0e))}
		$GetKeyboardState = {((e6 a3 d9 74) | (74 d9 a3 e6))}
		$GetSystemTime = {((5c a2 6a 16) | (16 6a a2 5c))}
		$FindWindowExA = {((72 83 1c 19) | (19 1c 83 72))}
		$RegQueryMultipleValuesA = {((4c 33 5b 13) | (13 5b 33 4c))}
		$DrawTextExA = {((04 44 e3 73) | (73 e3 44 04))}
		$RegEnumKeyExA = {((46 9e a1 bc) | (bc a1 9e 46))}
		$QueueUserAPC = {((94 9e 73 7a) | (7a 73 9e 94))}
		$RegSaveKeyA = {((ab 65 28 59) | (59 28 65 ab))}
		$CreateFileMappingA = {((2c e7 05 03) | (03 05 e7 2c))}
		$CryptDestroyKey = {((bd 4b 49 c7) | (c7 49 4b bd))}
		$RegDeleteKeyExA = {((2c d7 2a 3a) | (3a 2a d7 2c))}
		$EnumResourceTypesA = {((54 5b 78 f5) | (f5 78 5b 54))}
		$RegSetKeyValueA = {((9b d5 fd 73) | (73 fd d5 9b))}
		$timeSetEvent = {((11 30 ed 1f) | (1f ed 30 11))}
		$RegSaveKeyExA = {((19 50 c3 56) | (56 c3 50 19))}
		$CountClipboardFormats = {((6b f7 1d f7) | (f7 1d f7 6b))}
		$HttpAddRequestHeaders = {((6d 44 bf f0) | (f0 bf 44 6d))}
		$NtQueueApcThreadEx2 = {((06 0d e4 84) | (84 e4 0d 06))}
		$RegCopyTreeA = {((1d 50 35 0c) | (0c 35 50 1d))}
		$ImpersonateLoggedOnUser = {((cd e0 b3 f7) | (f7 b3 e0 cd))}
		$GetDriveTypeA = {((4e 4e fc df) | (df fc 4e 4e))}
		$GetVersionExA = {((1f 53 b5 46) | (46 b5 53 1f))}
		$InternetReadFile = {((19 b0 53 e7) | (e7 53 b0 19))}
		$RegOpenCurrentUser = {((99 7a a5 34) | (34 a5 7a 99))}
		$GetThreadLocale = {((15 45 c4 aa) | (aa c4 45 15))}
		$NtUnmapViewOfSection = {((98 db 30 6a) | (6a 30 db 98))}
		$FindNextFileA = {((cd 47 c2 a3) | (a3 c2 47 cd))}
		$GetLogicalProcessorInformation = {((ed c2 2c e3) | (e3 2c c2 ed))}
		$FlushEfsCache = {((22 89 ed f6) | (f6 ed 89 22))}
		$Closesocket = {((51 0a 54 01) | (01 54 0a 51))}
		$NetShareGetInfo = {((34 30 5a 08) | (08 5a 30 34))}
		$GetModuleHandleA = {((78 76 04 95) | (95 04 76 78))}
		$VirtualAlloc2FromApp = {((27 06 a3 5b) | (5b a3 06 27))}
		$MoveFileExA = {((6c bf cc d7) | (d7 cc bf 6c))}
		$NtWaitForMultipleObjects = {((40 42 17 76) | (76 17 42 40))}
		$DeleteFileA = {((d0 2c d2 36) | (36 d2 2c d0))}
		$StartServiceCtrlDispatcherA = {((dc 29 bb 7e) | (7e bb 29 dc))}
		$HttpOpenRequestA = {((0f 5d 7f 1e) | (1e 7f 5d 0f))}
		$GetThreadInformation = {((84 9e e9 20) | (20 e9 9e 84))}
		$NtDeleteKey = {((aa 64 83 00) | (00 83 64 aa))}
		$InternetWriteFile = {((24 c3 00 36) | (36 00 c3 24))}
		$LoadLibraryA = {((7d 9d 9f b8) | (b8 9f 9d 7d))}
		$RegQueryValueExA = {((89 f6 96 51) | (51 96 f6 89))}
		$NtCreateProcessEx = {((94 62 92 94) | (94 92 62 94))}
		$GetForegroundWindow = {((79 07 81 95) | (95 81 07 79))}
		$NtQuerySystemEnvironmentValueEx = {((56 6f 5c ce) | (ce 5c 6f 56))}
		$SizeOfResource = {((96 c9 d6 3a) | (3a d6 c9 96))}
		$RegGetValueA = {((97 dc 45 9e) | (9e 45 dc 97))}
		$LdrLoadDll = {((2f 40 b6 a0) | (a0 b6 40 2f))}
		$NtResumeThread = {((38 7f 8f 2d) | (2d 8f 7f 38))}
		$MapViewOfFile3 = {((59 b9 19 43) | (43 19 b9 59))}
		$NtQueryTimer = {((f0 b4 53 3b) | (3b 53 b4 f0))}
		$RtlCopyMemory = {((2f 2e 12 e8) | (e8 12 2e 2f))}
		$InternetConnectA = {((62 b4 26 96) | (96 26 b4 62))}
		$SetClipboardData = {((3e 04 e2 f8) | (f8 e2 04 3e))}
		$GetKeyState = {((b2 65 92 6c) | (6c 92 65 b2))}
		$WriteProcessMemory = {((a8 c9 f1 45) | (45 f1 c9 a8))}
		$RtlSetProcessIsCritical = {((4e c6 49 66) | (66 49 c6 4e))}
		$NetShareAdd = {((6b 18 49 25) | (25 49 18 6b))}
		$NtResumeProcess = {((2b a4 c9 34) | (34 c9 a4 2b))}
		$GetProcessHeaps = {((1d e8 3f 52) | (52 3f e8 1d))}
		$RegDeleteKeyTransactedA = {((2c 88 15 66) | (66 15 88 2c))}
		$ReadProcessMemory = {((a3 0c 91 36) | (36 91 0c a3))}
		$GetNativeSystemInfo = {((a7 e5 e0 ba) | (ba e0 e5 a7))}
		$ioctlsocket = {((ba 31 21 26) | (26 21 31 ba))}
		$CreateProcessAsUserA = {((ef de e7 e9) | (e9 e7 de ef))}
		$PeekNamedPipe = {((6e 84 11 fa) | (fa 11 84 6e))}
		$SuspendThread = {((65 8a d8 bc) | (bc d8 8a 65))}
		$CallWindowProcA = {((45 83 dc 0b) | (0b dc 83 45))}
		$OpenServiceA = {((9a 5e 07 86) | (86 07 5e 9a))}
		$SetTimer = {((14 e9 03 8f) | (8f 03 e9 14))}
		$MapViewOfFile2 = {((59 b9 19 42) | (42 19 b9 59))}
		$RegRestoreKeyA = {((38 b9 95 ae) | (ae 95 b9 38))}
		$InternetOpenUrlA = {((ad bd 68 f1) | (f1 68 bd ad))}
		$GetTempPathA = {((bc d7 28 a6) | (a6 28 d7 bc))}
		$NtAdjustPrivilegesToken = {((90 02 d8 6a) | (6a d8 02 90))}
		$GetTickCount = {((5f 8a c5 76) | (76 c5 8a 5f))}
		$RegSetValueExA = {((40 5c c4 e7) | (e7 c4 5c 40))}
		$NtCreateSection = {((5c bc b2 6d) | (6d b2 bc 5c))}
		$SetPropA = {((14 a5 9a b0) | (b0 9a a5 14))}
		$GetModuleFileNameExA = {((23 f1 65 07) | (07 65 f1 23))}
		$PathFileExistsA = {((d2 7c 68 30) | (30 68 7c d2))}
		$SetFocus = {((13 ee ce 4e) | (4e ce ee 13))}
		$GetDCEx = {((36 52 4d a6) | (a6 4d 52 36))}
		$WNetOpenEnumA = {((50 03 2b 08) | (08 2b 03 50))}
		$FindFirstFileA = {((ba 2a 88 cc) | (cc 88 2a ba))}
		$AttachThreadInput = {((cd 04 62 df) | (df 62 04 cd))}
		$AdjustTokenPrivileges = {((ff 3b 6d 28) | (28 6d 3b ff))}
		$EnumProcessModules = {((df 85 a8 0f) | (0f a8 85 df))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

723a50aa-38d5-4398-9ead-611441ea9357
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
