api_hashes_djb2_uppercase

YARA detection rule by filescanio
Rule api_hashes_djb2_uppercase (No description metadata provided).
import "math"
import "pe"
rule api_hashes_djb2_uppercase : hardened
{
	strings:
		$ControlService = {((0b 99 4e 49) | (49 4e 99 0b))}
		$HttpSendRequestA = {((26 8c 5a 6b) | (6b 5a 8c 26))}
		$SetThreadPriority = {((cd f2 d8 5d) | (5d d8 f2 cd))}
		$Recv = {((5b e2 fc 47) | (47 fc e2 5b))}
		$QueryPerformanceFrequency = {((98 8c 74 31) | (31 74 8c 98))}
		$RegDeleteValueA = {((77 81 94 e6) | (e6 94 81 77))}
		$GetWindowsDirectoryA = {((60 b7 8a f8) | (f8 8a b7 60))}
		$CryptSetKeyParam = {((07 21 de af) | (af de 21 07))}
		$RegCreateKeyExA = {((04 ae 32 50) | (50 32 ae 04))}
		$Module32Next = {((19 b8 1f e1) | (e1 1f b8 19))}
		$RegOpenUserClassesRoot = {((da ab 23 78) | (78 23 ab da))}
		$NtReadVirtualMemoryEx = {((1c 5e 28 72) | (72 28 5e 1c))}
		$InternetOpenA = {((b9 a9 76 d3) | (d3 76 a9 b9))}
		$URLOpenBlockingStream = {((ff 29 ec 51) | (51 ec 29 ff))}
		$NtSetInformationThread = {((bb 77 83 a3) | (a3 83 77 bb))}
		$CreateFileA = {((11 4a 9b ec) | (ec 9b 4a 11))}
		$UnhookWindowsHookEx = {((5c 05 a8 a4) | (a4 a8 05 5c))}
		$GetCurrentThreadId = {((ab 8b ef 7f) | (7f ef 8b ab))}
		$Accept = {((b8 c7 08 a7) | (a7 08 c7 b8))}
		$HeapReAlloc = {((e3 2d 2f 17) | (17 2f 2d e3))}
		$WinExec = {((7d ef 77 ca) | (ca 77 ef 7d))}
		$NtQueueApcThreadEx = {((13 6d f2 a7) | (a7 f2 6d 13))}
		$VirtualAllocFromApp = {((c1 8b af de) | (de af 8b c1))}
		$RegLoadKeyA = {((32 a1 dd ff) | (ff dd a1 32))}
		$OutputDebugStringA = {((1e eb 38 87) | (87 38 eb 1e))}
		$GetFileAttributesA = {((c8 e6 21 bf) | (bf 21 e6 c8))}
		$SetWaitableTimer = {((e1 0b 98 8d) | (8d 98 0b e1))}
		$SendMessageA = {((af 28 5c 87) | (87 5c 28 af))}
		$RegUnLoadKeyA = {((70 9b 85 82) | (82 85 9b 70))}
		$SetEnvironmentVariableA = {((cc f5 cb 9f) | (9f cb f5 cc))}
		$VirtualAlloc2 = {((4b 0c 0c db) | (db 0c 0c 4b))}
		$CryptProtectData = {((80 6f a7 e4) | (e4 a7 6f 80))}
		$GetDesktopWindow = {((41 43 19 89) | (89 19 43 41))}
		$RegGetKeySecurity = {((ef 08 e5 d6) | (d6 e5 08 ef))}
		$GetDC = {((d7 7b bd de) | (de bd 7b d7))}
		$LookupPrivilegeValueA = {((2b 45 91 d6) | (d6 91 45 2b))}
		$CryptGetHashParam = {((b1 f8 60 1e) | (1e 60 f8 b1))}
		$HeapAlloc = {((62 b2 1c a0) | (a0 1c b2 62))}
		$RegCloseKey = {((1f 17 20 f4) | (f4 20 17 1f))}
		$CryptHashData = {((91 2a f2 c7) | (c7 f2 2a 91))}
		$GlobalAlloc = {((e1 05 0f 13) | (13 0f 05 e1))}
		$RegOverridePredefKey = {((3c 3c a8 d4) | (d4 a8 3c 3c))}
		$EnumSystemLocalesA = {((5e 45 f3 75) | (75 f3 45 5e))}
		$GetProcessId = {((6a 9e 68 03) | (03 68 9e 6a))}
		$RegLoadMUIStringA = {((5a 53 d6 18) | (18 d6 53 5a))}
		$SearchPathA = {((fc 0c 15 bb) | (bb 15 0c fc))}
		$FindClose = {((f7 9b fa ae) | (ae fa 9b f7))}
		$NtDeleteValueKey = {((fa 3a f6 b2) | (b2 f6 3a fa))}
		$URLDownloadToFile = {((ce 9b 6a 65) | (65 6a 9b ce))}
		$Toolhelp32ReadProcessMemory = {((d0 30 b2 17) | (17 b2 30 d0))}
		$GetProcAddress = {((33 e7 af 71) | (71 af e7 33))}
		$OpenProcessToken = {((d4 bf 89 29) | (29 89 bf d4))}
		$HeapCreate = {((be 08 85 29) | (29 85 08 be))}
		$UuidFromStringA = {((9a fc 1e 5a) | (5a 1e fc 9a))}
		$VirtualProtectEx = {((56 35 b2 bc) | (bc b2 35 56))}
		$GetSystemTimeAsFileTime = {((10 c0 2c 0e) | (0e 2c c0 10))}
		$GetModuleBaseNameA = {((dd 14 1c 9a) | (9a 1c 14 dd))}
		$lstrcatA = {((25 af 4a b5) | (b5 4a af 25))}
		$SetFileAttributesA = {((f1 ef bb 4b) | (4b bb ef f1))}
		$FindResourceA = {((8e b7 64 61) | (61 64 b7 8e))}
		$WaitForMultipleObjects = {((75 29 41 69) | (69 41 29 75))}
		$QueryPerformanceCounter = {((0b cf c8 7f) | (7f c8 cf 0b))}
		$NtCreateThreadEx = {((a9 e2 f1 e2) | (e2 f1 e2 a9))}
		$NtContinue = {((4e eb 50 de) | (de 50 eb 4e))}
		$IsWoW64Process = {((8f 5a f9 f9) | (f9 f9 5a 8f))}
		$DnsQuery_A = {((d8 f2 93 72) | (72 93 f2 d8))}
		$VirtualProtectFromApp = {((b0 da f9 54) | (54 f9 da b0))}
		$GetAsyncKeyState = {((76 18 1e bf) | (bf 1e 18 76))}
		$EncryptFileA = {((47 ba 8b 5d) | (5d 8b ba 47))}
		$DuplicateToken = {((e6 26 e5 b3) | (b3 e5 26 e6))}
		$CryptDeriveKey = {((4c 41 8c 31) | (31 8c 41 4c))}
		$LockResource = {((2e 1e aa 88) | (88 aa 1e 2e))}
		$ResumeThread = {((50 44 ba 60) | (60 ba 44 50))}
		$WaitForSingleObjectEx = {((5e 3f 6d 09) | (09 6d 3f 5e))}
		$NtSuspendProcess = {((49 ed 86 7a) | (7a 86 ed 49))}
		$NetShareCheck = {((ff 30 3e 2f) | (2f 3e 30 ff))}
		$OpenThread = {((19 b8 1f 41) | (41 1f b8 19))}
		$URLOpenStream = {((ae f8 8d 88) | (88 8d f8 ae))}
		$UnmapViewOfFile = {((f7 10 ec e8) | (e8 ec 10 f7))}
		$CreateFile2 = {((11 4a 9b dd) | (dd 9b 4a 11))}
		$DeleteService = {((f6 ee 4f 7b) | (7b 4f ee f6))}
		$GetThreadId = {((d0 e3 18 1c) | (1c 18 e3 d0))}
		$RegDeleteKeyA = {((3e 25 a6 32) | (32 a6 25 3e))}
		$CreateTimerQueueTimer = {((b9 f9 d9 f2) | (f2 d9 f9 b9))}
		$SetProcessDEPPolicy = {((ce bf 7c 4b) | (4b 7c bf ce))}
		$CreateServiceA = {((35 31 1e 5d) | (5d 1e 31 35))}
		$ExitWindowsEx = {((1f f4 64 39) | (39 64 f4 1f))}
		$NtMapViewOfSection = {((ac 40 12 7c) | (7c 12 40 ac))}
		$NtTerminateThread = {((21 03 f0 7a) | (7a f0 03 21))}
		$Process32First = {((98 80 28 e3) | (e3 28 80 98))}
		$RegCreateKeyTransactedA = {((cd 8e 42 7c) | (7c 42 8e cd))}
		$GetUserNameA = {((bf 1e 57 78) | (78 57 1e bf))}
		$MapVirtualKeyA = {((9c db 3c 46) | (46 3c db 9c))}
		$WNetCloseEnum = {((cf f3 f6 20) | (20 f6 f3 cf))}
		$InternetReadFileExA = {((e6 79 ea da) | (da ea 79 e6))}
		$GetComputerNameA = {((87 1c fc 68) | (68 fc 1c 87))}
		$RegFlushKey = {((f1 dd 38 80) | (80 38 dd f1))}
		$VirtualAllocEx = {((ac 8d ab 06) | (06 ab 8d ac))}
		$GetSystemDefaultLangId = {((be 7c 88 b0) | (b0 88 7c be))}
		$SetFileTime = {((64 a7 bc d2) | (d2 bc a7 64))}
		$SendNotifyMessageA = {((e5 c9 a2 e0) | (e0 a2 c9 e5))}
		$LookupAccountNameA = {((4e 98 91 60) | (60 91 98 4e))}
		$NetShareEnum = {((d1 6f 45 c6) | (c6 45 6f d1))}
		$IcmpSendEcho = {((a9 8b ea a9) | (a9 ea 8b a9))}
		$DebugActiveProcessStop = {((c5 eb 68 ff) | (ff 68 eb c5))}
		$NtCreateFile = {((28 93 18 ed) | (ed 18 93 28))}
		$DecryptFileA = {((66 84 ce b3) | (b3 ce 84 66))}
		$GetRawInputData = {((d5 b9 31 ab) | (ab 31 b9 d5))}
		$BringWindowToTop = {((1e 21 17 17) | (17 17 21 1e))}
		$NetShareSetInfo = {((55 ef a8 09) | (09 a8 ef 55))}
		$GetLogicalDrives = {((55 d7 b7 9f) | (9f b7 d7 55))}
		$WriteFile = {((a6 c0 1e 42) | (42 1e c0 a6))}
		$BitBlt = {((bb 92 09 78) | (78 09 92 bb))}
		$SendMessageTimeoutA = {((86 48 d8 2e) | (2e d8 48 86))}
		$GetCurrentProcess = {((93 10 c7 d9) | (d9 c7 10 93))}
		$RegDeleteTreeA = {((03 84 15 99) | (99 15 84 03))}
		$CreateProcessWithTokenW = {((8a 90 bd fe) | (fe bd 90 8a))}
		$FindWindowA = {((4a f8 87 31) | (31 87 f8 4a))}
		$CopyFileA = {((ee d7 09 73) | (73 09 d7 ee))}
		$FtpPutFileA = {((f2 a1 d0 5b) | (5b d0 a1 f2))}
		$NtOpenProcess = {((5d 9a f6 8a) | (8a f6 9a 5d))}
		$Send = {((5b e3 8a 01) | (01 8a e3 5b))}
		$EnumDeviceDrivers = {((bd a5 6b 9b) | (9b 6b a5 bd))}
		$Process32Next = {((9f ca 25 7a) | (7a 25 ca 9f))}
		$GetWindowDC = {((d9 44 15 f6) | (f6 15 44 d9))}
		$CryptDecrypt = {((0f 03 b8 44) | (44 b8 03 0f))}
		$ReadFile = {((4c 3d 60 93) | (93 60 3d 4c))}
		$VirtualProtect = {((3d 6f 3d bf) | (bf 3d 6f 3d))}
		$OpenProcess = {((33 ef 5b a8) | (a8 5b ef 33))}
		$WaitForMultipleObjectsEx = {((64 7f 48 e6) | (e6 48 7f 64))}
		$Inet_addr = {((64 d5 52 a1) | (a1 52 d5 64))}
		$WSAStartup = {((66 df 6e 75) | (75 6e df 66))}
		$Bind = {((5b da 48 94) | (94 48 da 5b))}
		$GetTempFileNameA = {((e5 50 cc 8f) | (8f cc 50 e5))}
		$CreateMutexExA = {((7e c8 e2 7c) | (7c e2 c8 7e))}
		$DeviceIoControl = {((89 38 2f 40) | (40 2f 38 89))}
		$CryptDestroyHash = {((e2 8f 37 77) | (77 37 8f e2))}
		$CryptEncrypt = {((70 fc 62 ae) | (ae 62 fc 70))}
		$NtSetContextThread = {((d5 7c 35 c2) | (c2 35 7c d5))}
		$CryptReleaseContext = {((f8 91 e5 ef) | (ef e5 91 f8))}
		$StretchBlt = {((45 ff d2 d6) | (d6 d2 ff 45))}
		$NtWaitForSingleObject = {((f5 bd 5d ae) | (ae 5d bd f5))}
		$LoadLibraryExA = {((ea aa 9c ea) | (ea 9c aa ea))}
		$PeekMessageA = {((27 56 41 42) | (42 41 56 27))}
		$WNetAddConnectionA = {((dd b5 61 ef) | (ef 61 b5 dd))}
		$NtCreateThread = {((ba 56 7b 65) | (65 7b 56 ba))}
		$ShellExecuteExA = {((71 10 85 80) | (80 85 10 71))}
		$GetMessageA = {((77 7a 1b 9d) | (9d 1b 7a 77))}
		$GetCurrentHwProfileA = {((92 0f 9d cb) | (cb 9d 0f 92))}
		$PostThreadMessageA = {((67 af 16 bb) | (bb 16 af 67))}
		$RegOpenKeyExA = {((95 fb 4d ce) | (ce 4d fb 95))}
		$CreateWaitableTimer = {((4a fb 21 15) | (15 21 fb 4a))}
		$NtSetInformationProcess = {((0d 9b 4c 4a) | (4a 4c 9b 0d))}
		$InternetSetOptionA = {((b4 f1 9f e6) | (e6 9f f1 b4))}
		$GetClipboardData = {((67 ae 0f c1) | (c1 0f ae 67))}
		$HttpSendRequestExA = {((fb 0c bd c8) | (c8 bd 0c fb))}
		$CreateProcessA = {((50 c7 7e 6b) | (6b 7e c7 50))}
		$CreateToolhelp32Snapshot = {((5f 94 f4 67) | (67 f4 94 5f))}
		$GetProcessHeap = {((8b d7 f5 54) | (54 f5 d7 8b))}
		$MapVirtualKeyExA = {((40 9b 82 63) | (63 82 9b 40))}
		$NtTerminateProcess = {((24 b5 54 01) | (01 54 b5 24))}
		$CallNextHookEx = {((f1 69 4f c0) | (c0 4f 69 f1))}
		$TerminateProcess = {((ee 8b 9b df) | (df 9b 8b ee))}
		$GetIpNetTable = {((89 e0 b1 bf) | (bf b1 e0 89))}
		$SetThreadToken = {((1f 0c 84 1c) | (1c 84 0c 1f))}
		$SetCurrentDirectory = {((0b ee 81 fb) | (fb 81 ee 0b))}
		$GetFileTime = {((24 4f 3d c6) | (c6 3d 4f 24))}
		$CreateRemoteThread = {((fb 06 8c 2f) | (2f 8c 06 fb))}
		$KeInsertQueueApc = {((ae d0 e7 f5) | (f5 e7 d0 ae))}
		$SetWindowsHookExA = {((34 b2 e2 7d) | (7d e2 b2 34))}
		$EnumWindows = {((57 88 3a 97) | (97 3a 88 57))}
		$NtSetSystemEnvironmentValueEx = {((4b dc 42 99) | (99 42 dc 4b))}
		$GetKeynameTextA = {((d7 6f ae c7) | (c7 ae 6f d7))}
		$CryptCreateHash = {((4e e4 80 e1) | (e1 80 e4 4e))}
		$CreateThread = {((5b 37 84 43) | (43 84 37 5b))}
		$GetCurrentThread = {((05 54 49 52) | (52 49 54 05))}
		$EnumResourceTypesExA = {((96 df 2c 87) | (87 2c df 96))}
		$OpenSCManagerA = {((6d e1 dc 1b) | (1b dc e1 6d))}
		$NtWriteVirtualMemory = {((7d aa ec c4) | (c4 ec aa 7d))}
		$WSASocketA = {((5b 55 bd ac) | (ac bd 55 5b))}
		$SetWindowLongPtrA = {((d6 da c9 e2) | (e2 c9 da d6))}
		$CryptAcquireContextA = {((7f 7c 05 79) | (79 05 7c 7f))}
		$Thread32Next = {((47 d5 36 13) | (13 36 d5 47))}
		$RegisterRawInputDevices = {((f0 33 66 99) | (99 66 33 f0))}
		$Gethostbyname = {((07 b1 23 51) | (51 23 b1 07))}
		$GetLogicalProcessorInformationEx = {((6c b0 d2 95) | (95 d2 b0 6c))}
		$CreateWindowExA = {((00 df c1 01) | (01 c1 df 00))}
		$GetTickCount64 = {((c6 03 a8 b5) | (b5 a8 03 c6))}
		$SendMessageCallbackA = {((f3 75 18 94) | (94 18 75 f3))}
		$WNetAddConnection2A = {((94 61 9e 21) | (21 9e 61 94))}
		$ShellExecuteA = {((83 0a d4 23) | (23 d4 0a 83))}
		$CryptGenRandom = {((89 55 2a 24) | (24 2a 55 89))}
		$RegConnectRegistryA = {((96 5a af 39) | (39 af 5a 96))}
		$CryptBinaryToString = {((4b 73 1f 88) | (88 1f 73 4b))}
		$RtlMoveMemory = {((92 b2 a4 39) | (39 a4 b2 92))}
		$CopyFile2 = {((ee d7 09 64) | (64 09 d7 ee))}
		$TimeGetTime = {((35 4c a4 55) | (55 a4 4c 35))}
		$Thread32First = {((41 ed 4c 9c) | (9c 4c ed 41))}
		$PostMessageA = {((ad e9 3e a3) | (a3 3e e9 ad))}
		$WSACleanup = {((84 d1 53 6a) | (6a 53 d1 84))}
		$NtShutdownSystem = {((1b e6 ef 7a) | (7a ef e6 1b))}
		$GetModuleFileNameA = {((f6 3c de 5f) | (5f de 3c f6))}
		$Socket = {((e3 9d 22 20) | (20 22 9d e3))}
		$NtCreateUserProcess = {((e6 18 ac 6b) | (6b ac 18 e6))}
		$GetCurrentProcessId = {((9a 62 2b c6) | (c6 2b 62 9a))}
		$InternetCloseHandle = {((18 ed 61 e2) | (e2 61 ed 18))}
		$OpenFileMappingA = {((08 ff fa f6) | (f6 fa ff 08))}
		$NtQueryDirectoryFile = {((46 28 fc a4) | (a4 fc 28 46))}
		$GetAdaptersInfo = {((2f e0 7e 37) | (37 7e e0 2f))}
		$MapViewOfFile = {((a0 a0 6b 05) | (05 6b a0 a0))}
		$TerminateThread = {((27 21 b4 98) | (98 b4 21 27))}
		$ControlServiceExA = {((3b e7 c6 c7) | (c7 c6 e7 3b))}
		$CreateProcessInternal = {((90 7f 1d 07) | (07 1d 7f 90))}
		$CreateMutexA = {((4b cf c2 1f) | (1f c2 cf 4b))}
		$WSAIoctl = {((1f 95 2c fd) | (fd 2c 95 1f))}
		$RegOpenKeyTransactedA = {((d1 05 fb fa) | (fa fb 05 d1))}
		$Connect = {((88 66 4a e1) | (e1 4a 66 88))}
		$RegQueryInfoKeyA = {((a9 3c 2b e1) | (e1 2b 3c a9))}
		$RegSetKeySecurity = {((b6 0b 99 62) | (62 99 0b b6))}
		$NtClose = {((e2 08 b8 8f) | (8f b8 08 e2))}
		$Sleep = {((d8 58 7a f0) | (f0 7a 58 d8))}
		$NtProtectVirtualMemory = {((00 24 a8 3a) | (3a a8 24 00))}
		$NtReadVirtualMemory = {((34 72 cd f5) | (f5 cd 72 34))}
		$Gethostname = {((dc 10 73 b6) | (b6 73 10 dc))}
		$CopyFileExA = {((00 bf 4e d0) | (d0 4e bf 00))}
		$Wow64SetThreadContext = {((5e 7d 02 47) | (47 02 7d 5e))}
		$EnumProcessModulesEx = {((9c a4 72 a1) | (a1 72 a4 9c))}
		$GetSystemDirectoryA = {((ce aa 8b 72) | (72 8b aa ce))}
		$NtCreateProcess = {((e8 59 3c 4c) | (4c 3c 59 e8))}
		$SetThreadContext = {((f7 de 5a e0) | (e0 5a de f7))}
		$DnsQueryEx = {((d8 f2 90 2f) | (2f 90 f2 d8))}
		$LoadResource = {((f6 a2 71 3f) | (3f 71 a2 f6))}
		$NtAllocateVirtualMemory = {((8e 2f 2e de) | (de 2e 2f 8e))}
		$ConnectNamedPipe = {((3e 38 6e 94) | (94 6e 38 3e))}
		$RegDeleteKeyValueA = {((bf ff 02 ef) | (ef 02 ff bf))}
		$CreatePipe = {((e9 45 ce 99) | (99 ce 45 e9))}
		$NtDelayExecution = {((f0 73 58 dc) | (dc 58 73 f0))}
		$RtlGetVersion = {((1f f6 5c 4f) | (4f 5c f6 1f))}
		$NtOpenThread = {((59 0a e5 e3) | (e3 e5 0a 59))}
		$RegReplaceKeyA = {((da 04 7e 1b) | (1b 7e 04 da))}
		$RtlCreateHeap = {((f3 c7 67 bb) | (bb 67 c7 f3))}
		$CheckRemoteDebuggerPresent = {((dc 8d 82 07) | (07 82 8d dc))}
		$GetProcessIdOfThread = {((d1 ef 67 90) | (90 67 ef d1))}
		$SetForegroundWindow = {((06 75 eb 76) | (76 eb 75 06))}
		$SetWinEventHook = {((a9 64 50 44) | (44 50 64 a9))}
		$RegisterHotKey = {((e7 7c cf f0) | (f0 cf 7c e7))}
		$NtQueryInformationProcess = {((7c 3d 18 34) | (34 18 3d 7c))}
		$CreateRemoteThreadEx = {((d6 da 5d 2c) | (2c 5d da d6))}
		$OpenClipboard = {((c9 95 12 39) | (39 12 95 c9))}
		$RegEnumValueA = {((15 15 4f 68) | (68 4f 15 15))}
		$URLDownloadToCacheFile = {((ed 9e 4c 79) | (79 4c 9e ed))}
		$LocalAlloc = {((c4 b8 20 0d) | (0d 20 b8 c4))}
		$ShowWindow = {((7c 6c ad d0) | (d0 ad 6c 7c))}
		$VirtualQueryEx = {((90 b3 3b f1) | (f1 3b b3 90))}
		$NtQueueApcThread = {((05 30 86 ea) | (ea 86 30 05))}
		$NtMakeTemporaryObject = {((fb ff fd f1) | (f1 fd ff fb))}
		$VirtualAllocExNuma = {((42 03 f7 57) | (57 f7 03 42))}
		$RegOpenKeyA = {((4e 6b 30 f1) | (f1 30 6b 4e))}
		$EnumDesktopWindows = {((4f 2a 0c 91) | (91 0c 2a 4f))}
		$WaitForSingleObject = {((9f 3c 00 cc) | (cc 00 3c 9f))}
		$FindResourceExA = {((1a 22 1d 3e) | (3e 1d 22 1a))}
		$CryptStringToBinary = {((29 24 31 88) | (88 31 24 29))}
		$RegEnumKeyA = {((9f 24 d8 34) | (34 d8 24 9f))}
		$Select = {((e2 ed 02 b7) | (b7 02 ed e2))}
		$WNetEnumResourceA = {((5d c8 86 f3) | (f3 86 c8 5d))}
		$EnumProcesses = {((c3 58 98 03) | (03 98 58 c3))}
		$Listen = {((d2 e5 5f 06) | (06 5f e5 d2))}
		$RegCreateKeyA = {((7a b7 0c f3) | (f3 0c b7 7a))}
		$IsDebuggerPresent = {((b0 0c 1e f9) | (f9 1e 0c b0))}
		$FindNextUrlCacheEntryA = {((6d 62 ce b1) | (b1 ce 62 6d))}
		$StartServiceA = {((c9 ce 75 57) | (57 75 ce c9))}
		$GetThreadContext = {((65 60 94 54) | (54 94 60 65))}
		$VirtualAlloc = {((cb f8 9b 89) | (89 9b f8 cb))}
		$Module32First = {((50 2d 70 2a) | (2a 70 2d 50))}
		$FindFirstUrlCacheEntryA = {((dc c4 d9 7a) | (7a d9 c4 dc))}
		$SleepEx = {((50 63 00 2d) | (2d 00 63 50))}
		$MoveFileA = {((1a e9 b3 6f) | (6f b3 e9 1a))}
		$NtSetValueKey = {((eb b8 15 ab) | (ab 15 b8 eb))}
		$SetWindowLongA = {((56 6a 3b 8c) | (8c 3b 6a 56))}
		$MapViewOfFileEx = {((4a 67 49 82) | (82 49 67 4a))}
		$NtDuplicateObject = {((98 50 40 cb) | (cb 40 50 98))}
		$GetKeyboardState = {((a4 fc 50 c9) | (c9 50 fc a4))}
		$GetSystemTime = {((c7 2b 89 eb) | (eb 89 2b c7))}
		$FindWindowExA = {((eb 37 34 0e) | (0e 34 37 eb))}
		$RegQueryMultipleValuesA = {((80 e3 70 28) | (28 70 e3 80))}
		$DrawTextExA = {((13 a9 7e 68) | (68 7e a9 13))}
		$RegEnumKeyExA = {((fb bb d1 d1) | (d1 d1 bb fb))}
		$QueueUserAPC = {((a7 92 65 0f) | (0f 65 92 a7))}
		$RegSaveKeyA = {((a3 cd cb 4e) | (4e cb cd a3))}
		$CreateFileMappingA = {((81 ab 99 78) | (78 99 ab 81))}
		$CryptDestroyKey = {((06 dd 9a 9c) | (9c 9a dd 06))}
		$RegDeleteKeyExA = {((5e 28 17 4f) | (4f 17 28 5e))}
		$EnumResourceTypesA = {((b5 26 0d 6a) | (6a 0d 26 b5))}
		$RegSetKeyValueA = {((5c b4 82 88) | (88 82 b4 5c))}
		$timeSetEvent = {((f0 ee ba 54) | (54 ba ee f0))}
		$RegSaveKeyExA = {((ce 6d f3 6b) | (6b f3 6d ce))}
		$CountClipboardFormats = {((1c f9 35 cc) | (cc 35 f9 1c))}
		$HttpAddRequestHeaders = {((5a e5 8f e5) | (e5 8f e5 5a))}
		$NtQueueApcThreadEx2 = {((81 2c 47 b9) | (b9 47 2c 81))}
		$RegCopyTreeA = {((22 cd 32 81) | (81 32 cd 22))}
		$ImpersonateLoggedOnUser = {((de 97 f8 ec) | (ec f8 97 de))}
		$GetDriveTypeA = {((bb 09 a0 d4) | (d4 a0 09 bb))}
		$GetVersionExA = {((89 cb d1 3b) | (3b d1 cb 89))}
		$InternetReadFile = {((72 30 b3 3c) | (3c b3 30 72))}
		$RegOpenCurrentUser = {((5c 2e dd a9) | (a9 dd 2e 5c))}
		$GetThreadLocale = {((46 96 29 7f) | (7f 29 96 46))}
		$NtUnmapViewOfSection = {((25 37 fd ff) | (ff fd 37 25))}
		$FindNextFileA = {((48 3e 62 98) | (98 62 3e 48))}
		$GetLogicalProcessorInformation = {((c2 be 93 58) | (58 93 be c2))}
		$FlushEfsCache = {((96 2d 09 cb) | (cb 09 2d 96))}
		$Closesocket = {((c1 26 ce 96) | (96 ce 26 c1))}
		$NetShareGetInfo = {((ba 34 ce fd) | (fd ce 34 ba))}
		$GetModuleHandleA = {((d3 d3 04 0a) | (0a 04 d3 d3))}
		$VirtualAlloc2FromApp = {((e9 4c 30 f0) | (f0 30 4c e9))}
		$MoveFileExA = {((7c 24 67 cc) | (cc 67 24 7c))}
		$NtWaitForMultipleObjects = {((fa f9 0b 0b) | (0b 0b f9 fa))}
		$DeleteFileA = {((42 8c 5d 0b) | (0b 5d 8c 42))}
		$StartServiceCtrlDispatcherA = {((29 fe 92 93) | (93 92 fe 29))}
		$HttpOpenRequestA = {((86 37 fe 93) | (93 fe 37 86))}
		$GetThreadInformation = {((3a 53 72 75) | (75 72 53 3a))}
		$NtDeleteKey = {((aa 0f a5 d5) | (d5 a5 0f aa))}
		$InternetWriteFile = {((8b 1d c6 0b) | (0b c6 1d 8b))}
		$LoadLibraryA = {((79 84 09 0d) | (0d 09 84 79))}
		$RegQueryValueExA = {((ce 47 21 e6) | (e6 21 47 ce))}
		$NtCreateProcessEx = {((63 99 88 89) | (89 88 99 63))}
		$GetForegroundWindow = {((bc 39 20 6a) | (6a 20 39 bc))}
		$NtQuerySystemEnvironmentValueEx = {((3a 25 d6 03) | (03 d6 25 3a))}
		$SizeOfResource = {((ae 29 f8 8f) | (8f f8 29 ae))}
		$RegGetValueA = {((e5 bb 47 13) | (13 47 bb e5))}
		$LdrLoadDll = {((f0 f6 4e f5) | (f5 4e f6 f0))}
		$NtResumeThread = {((af 63 b1 82) | (82 b1 63 af))}
		$MapViewOfFile3 = {((b4 ad cb d8) | (d8 cb ad b4))}
		$NtQueryTimer = {((e7 f5 54 90) | (90 54 f5 e7))}
		$RtlCopyMemory = {((e4 4a ba bd) | (bd ba 4a e4))}
		$InternetConnectA = {((bb 22 f9 eb) | (eb f9 22 bb))}
		$SetClipboardData = {((fa 2b d6 4d) | (4d d6 2b fa))}
		$GetKeyState = {((ac ff b9 41) | (41 b9 ff ac))}
		$WriteProcessMemory = {((8d 6e 81 9a) | (9a 81 6e 8d))}
		$RtlSetProcessIsCritical = {((e0 0a 0e 7b) | (7b 0e 0a e0))}
		$NetShareAdd = {((63 6f e7 fa) | (fa e7 6f 63))}
		$NtResumeProcess = {((7f 0d 36 09) | (09 36 0d 7f))}
		$GetProcessHeaps = {((06 d6 a0 27) | (27 a0 d6 06))}
		$RegDeleteKeyTransactedA = {((6c a0 b6 7b) | (7b b6 a0 6c))}
		$ReadProcessMemory = {((b0 4d ef 0b) | (0b ef 4d b0))}
		$GetNativeSystemInfo = {((21 d6 1b af) | (af 1b d6 21))}
		$ioctlsocket = {((7e b6 f3 9b) | (9b f3 b6 7e))}
		$CreateProcessAsUserA = {((a8 52 65 7e) | (7e 65 52 a8))}
		$PeekNamedPipe = {((e7 49 2d cf) | (cf 2d 49 e7))}
		$SuspendThread = {((99 55 5c 71) | (71 5c 55 99))}
		$CallWindowProcA = {((bb 9d 39 00) | (00 39 9d bb))}
		$OpenServiceA = {((96 44 70 db) | (db 70 44 96))}
		$SetTimer = {((65 f4 76 c4) | (c4 76 f4 65))}
		$MapViewOfFile2 = {((b4 ad cb d7) | (d7 cb ad b4))}
		$RegRestoreKeyA = {((f2 35 2c 23) | (23 2c 35 f2))}
		$InternetOpenUrlA = {((06 3d c8 66) | (66 c8 3d 06))}
		$GetTempPathA = {((c2 54 26 1b) | (1b 26 54 c2))}
		$NtAdjustPrivilegesToken = {((c4 67 e9 5f) | (5f e9 67 c4))}
		$GetTickCount = {((65 07 c2 cb) | (cb c2 07 65))}
		$RegSetValueExA = {((82 01 f3 7c) | (7c f3 01 82))}
		$NtCreateSection = {((b0 25 1f 42) | (42 1f 25 b0))}
		$SetPropA = {((65 b1 0e 05) | (05 0e b1 65))}
		$GetModuleFileNameExA = {((78 ee 0e bc) | (bc 0e ee 78))}
		$PathFileExistsA = {((e5 9a 4d 25) | (25 4d 9a e5))}
		$SetFocus = {((64 fa 41 83) | (83 41 fa 64))}
		$GetDCEx = {((a5 62 b6 9b) | (9b b6 62 a5))}
		$WNetOpenEnumA = {((e9 65 77 1d) | (1d 77 65 e9))}
		$FindFirstFileA = {((4b 93 1f 41) | (41 1f 93 4b))}
		$AttachThreadInput = {((51 99 34 b4) | (b4 34 99 51))}
		$AdjustTokenPrivileges = {((74 91 0c fd) | (fd 0c 91 74))}
		$EnumProcessModules = {((94 f2 c0 64) | (64 c0 f2 94))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

36b2017e-6eb3-413a-8fd7-bfe8fba816e7
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
