api_hashes_deedrat_export_name

YARA detection rule by filescanio
Rule api_hashes_deedrat_export_name (No description metadata provided).
import "math"
import "pe"
rule api_hashes_deedrat_export_name : hardened
{
	strings:
		$ControlService = {((5a 9a 0d 31) | (31 0d 9a 5a))}
		$HttpSendRequestA = {((1d dd 6f c1) | (c1 6f dd 1d))}
		$SetThreadPriority = {((07 59 33 11) | (11 33 59 07))}
		$Recv = {((58 f5 00 49) | (49 00 f5 58))}
		$QueryPerformanceFrequency = {((50 73 cf 60) | (60 cf 73 50))}
		$RegDeleteValueA = {((43 f3 dc 89) | (89 dc f3 43))}
		$GetWindowsDirectoryA = {((17 59 d3 ed) | (ed d3 59 17))}
		$CryptSetKeyParam = {((08 9f d1 8a) | (8a d1 9f 08))}
		$RegCreateKeyExA = {((39 36 36 0a) | (0a 36 36 39))}
		$Module32Next = {((59 b7 cb 44) | (44 cb b7 59))}
		$RegOpenUserClassesRoot = {((5e 62 d2 93) | (93 d2 62 5e))}
		$NtReadVirtualMemoryEx = {((29 70 a1 84) | (84 a1 70 29))}
		$InternetOpenA = {((65 4a a3 a8) | (a8 a3 4a 65))}
		$URLOpenBlockingStream = {((1a 96 28 5d) | (5d 28 96 1a))}
		$NtSetInformationThread = {((3f 6c 1e 1f) | (1f 1e 6c 3f))}
		$CreateFileA = {((5d 15 dc 83) | (83 dc 15 5d))}
		$UnhookWindowsHookEx = {((0c 58 6d 2a) | (2a 6d 58 0c))}
		$GetCurrentThreadId = {((6d 89 af 59) | (59 af 89 6d))}
		$Accept = {((29 11 39 7a) | (7a 39 11 29))}
		$HeapReAlloc = {((6e ec 3a 48) | (48 3a ec 6e))}
		$WinExec = {((26 ac 5a 6a) | (6a 5a ac 26))}
		$NtQueueApcThreadEx = {((2a b3 b6 79) | (79 b6 b3 2a))}
		$VirtualAllocFromApp = {((58 1c 20 c4) | (c4 20 1c 58))}
		$RegLoadKeyA = {((09 dc 04 7d) | (7d 04 dc 09))}
		$OutputDebugStringA = {((33 85 3c a4) | (a4 3c 85 33))}
		$GetFileAttributesA = {((25 da cb 76) | (76 cb da 25))}
		$SetWaitableTimer = {((2b 37 2f f5) | (f5 2f 37 2b))}
		$SendMessageA = {((4e da 35 73) | (73 35 da 4e))}
		$RegUnLoadKeyA = {((57 95 52 f7) | (f7 52 95 57))}
		$SetEnvironmentVariableA = {((63 9d a1 f8) | (f8 a1 9d 63))}
		$VirtualAlloc2 = {((12 22 40 6f) | (6f 40 22 12))}
		$CryptProtectData = {((1b 4f b5 fc) | (fc b5 4f 1b))}
		$GetDesktopWindow = {((2c 16 66 c8) | (c8 66 16 2c))}
		$RegGetKeySecurity = {((0e 0e 5f 34) | (34 5f 0e 0e))}
		$GetDC = {((3a 6e 03 d8) | (d8 03 6e 3a))}
		$LookupPrivilegeValueA = {((55 37 12 ad) | (ad 12 37 55))}
		$CryptGetHashParam = {((4f 49 7e e5) | (e5 7e 49 4f))}
		$HeapAlloc = {((66 4a 17 5f) | (5f 17 4a 66))}
		$RegCloseKey = {((27 fc a7 6e) | (6e a7 fc 27))}
		$CryptHashData = {((18 18 fc e1) | (e1 fc 18 18))}
		$GlobalAlloc = {((6b cf 51 aa) | (aa 51 cf 6b))}
		$RegOverridePredefKey = {((35 6d 06 50) | (50 06 6d 35))}
		$EnumSystemLocalesA = {((22 80 68 10) | (10 68 80 22))}
		$GetProcessId = {((21 87 32 15) | (15 32 87 21))}
		$RegLoadMUIStringA = {((5b 3d 7d ea) | (ea 7d 3d 5b))}
		$SearchPathA = {((10 36 bd b5) | (b5 bd 36 10))}
		$FindClose = {((00 cc 5c 4f) | (4f 5c cc 00))}
		$NtDeleteValueKey = {((6a 39 2a 93) | (93 2a 39 6a))}
		$URLDownloadToFile = {((1f 4d 53 a6) | (a6 53 4d 1f))}
		$Toolhelp32ReadProcessMemory = {((6a a6 51 0e) | (0e 51 a6 6a))}
		$GetProcAddress = {((65 8d 46 d3) | (d3 46 8d 65))}
		$OpenProcessToken = {((62 4a a6 f9) | (f9 a6 4a 62))}
		$HeapCreate = {((41 9b 84 80) | (80 84 9b 41))}
		$UuidFromStringA = {((29 27 6c a8) | (a8 6c 27 29))}
		$VirtualProtectEx = {((5a f5 42 e4) | (e4 42 f5 5a))}
		$GetSystemTimeAsFileTime = {((62 f0 c2 a5) | (a5 c2 f0 62))}
		$GetModuleBaseNameA = {((3c 61 91 d5) | (d5 91 61 3c))}
		$lstrcatA = {((76 3a c8 72) | (72 c8 3a 76))}
		$SetFileAttributesA = {((75 f4 91 99) | (99 91 f4 75))}
		$FindResourceA = {((70 b0 f3 d8) | (d8 f3 b0 70))}
		$WaitForMultipleObjects = {((0a 0b 22 19) | (19 22 0b 0a))}
		$QueryPerformanceCounter = {((4f f4 71 5e) | (5e 71 f4 4f))}
		$NtCreateThreadEx = {((32 ce 6f 87) | (87 6f ce 32))}
		$NtContinue = {((55 93 10 fa) | (fa 10 93 55))}
		$IsWoW64Process = {((11 86 66 82) | (82 66 86 11))}
		$DnsQuery_A = {((30 dd e0 f8) | (f8 e0 dd 30))}
		$VirtualProtectFromApp = {((02 c7 ee b2) | (b2 ee c7 02))}
		$GetAsyncKeyState = {((2c d9 3b bb) | (bb 3b d9 2c))}
		$EncryptFileA = {((57 bb 36 99) | (99 36 bb 57))}
		$DuplicateToken = {((6c a7 3b 02) | (02 3b a7 6c))}
		$CryptDeriveKey = {((65 37 a5 00) | (00 a5 37 65))}
		$LockResource = {((7d 8f 1c fa) | (fa 1c 8f 7d))}
		$ResumeThread = {((0e de d2 8f) | (8f d2 de 0e))}
		$WaitForSingleObjectEx = {((18 97 7c 35) | (35 7c 97 18))}
		$NtSuspendProcess = {((1e 29 b6 f3) | (f3 b6 29 1e))}
		$NetShareCheck = {((66 d3 2e 82) | (82 2e d3 66))}
		$OpenThread = {((1c 74 12 48) | (48 12 74 1c))}
		$URLOpenStream = {((5b b1 ee 58) | (58 ee b1 5b))}
		$UnmapViewOfFile = {((41 9c f4 c9) | (c9 f4 9c 41))}
		$CreateFile2 = {((5d 15 dc f0) | (f0 dc 15 5d))}
		$DeleteService = {((63 61 20 e5) | (e5 20 61 63))}
		$GetThreadId = {((4a 1a a3 ec) | (ec a3 1a 4a))}
		$RegDeleteKeyA = {((1b 57 c8 5a) | (5a c8 57 1b))}
		$CreateTimerQueueTimer = {((19 21 df 58) | (58 df 21 19))}
		$SetProcessDEPPolicy = {((28 13 20 54) | (54 20 13 28))}
		$CreateServiceA = {((49 90 35 43) | (43 35 90 49))}
		$ExitWindowsEx = {((14 58 6a 84) | (84 6a 58 14))}
		$NtMapViewOfSection = {((77 eb 9a eb) | (eb 9a eb 77))}
		$NtTerminateThread = {((64 1e 9b ba) | (ba 9b 1e 64))}
		$Process32First = {((5d e2 e4 a5) | (a5 e4 e2 5d))}
		$RegCreateKeyTransactedA = {((5d 2b 27 01) | (01 27 2b 5d))}
		$GetUserNameA = {((7f f4 6d a8) | (a8 6d f4 7f))}
		$MapVirtualKeyA = {((75 cd 93 67) | (67 93 cd 75))}
		$WNetCloseEnum = {((4c 78 85 3f) | (3f 85 78 4c))}
		$InternetReadFileExA = {((2a cf a1 19) | (19 a1 cf 2a))}
		$GetComputerNameA = {((6a 46 49 9f) | (9f 49 46 6a))}
		$RegFlushKey = {((7a 6a a9 de) | (de a9 6a 7a))}
		$VirtualAllocEx = {((2b 19 c7 9c) | (9c c7 19 2b))}
		$GetSystemDefaultLangId = {((3d 45 02 48) | (48 02 45 3d))}
		$SetFileTime = {((09 2a 16 c6) | (c6 16 2a 09))}
		$SendNotifyMessageA = {((72 7f 7e 19) | (19 7e 7f 72))}
		$LookupAccountNameA = {((5e 97 ea 30) | (30 ea 97 5e))}
		$NetShareEnum = {((14 c2 e4 2d) | (2d e4 c2 14))}
		$IcmpSendEcho = {((65 ca 1c a3) | (a3 1c ca 65))}
		$DebugActiveProcessStop = {((50 fa 6a 34) | (34 6a fa 50))}
		$NtCreateFile = {((27 d7 9f e9) | (e9 9f d7 27))}
		$DecryptFileA = {((50 8d 09 68) | (68 09 8d 50))}
		$GetRawInputData = {((7d e6 9c 26) | (26 9c e6 7d))}
		$BringWindowToTop = {((3d 1f 55 ad) | (ad 55 1f 3d))}
		$NetShareSetInfo = {((4a b4 72 95) | (95 72 b4 4a))}
		$GetLogicalDrives = {((2d 8c 92 64) | (64 92 8c 2d))}
		$WriteFile = {((66 b8 16 99) | (99 16 b8 66))}
		$BitBlt = {((2c 9c fd 00) | (00 fd 9c 2c))}
		$SendMessageTimeoutA = {((56 eb 1d ca) | (ca 1d eb 56))}
		$GetCurrentProcess = {((66 e6 a6 a6) | (a6 a6 e6 66))}
		$RegDeleteTreeA = {((23 87 52 1f) | (1f 52 87 23))}
		$CreateProcessWithTokenW = {((67 62 3d 9d) | (9d 3d 62 67))}
		$FindWindowA = {((2d 8d 82 de) | (de 82 8d 2d))}
		$CopyFileA = {((59 df 7b 8f) | (8f 7b df 59))}
		$FtpPutFileA = {((14 a2 25 d4) | (d4 25 a2 14))}
		$NtOpenProcess = {((7b f1 9e c8) | (c8 9e f1 7b))}
		$Send = {((58 73 13 12) | (12 13 73 58))}
		$EnumDeviceDrivers = {((3b 7c 83 b0) | (b0 83 7c 3b))}
		$Process32Next = {((4f f1 08 41) | (41 08 f1 4f))}
		$GetWindowDC = {((7d de 66 83) | (83 66 de 7d))}
		$CryptDecrypt = {((0e 76 0e 03) | (03 0e 76 0e))}
		$ReadFile = {((59 42 45 c5) | (c5 45 42 59))}
		$VirtualProtect = {((1a 52 16 bc) | (bc 16 52 1a))}
		$OpenProcess = {((28 2b ef 37) | (37 ef 2b 28))}
		$WaitForMultipleObjectsEx = {((35 b8 b1 f9) | (f9 b1 b8 35))}
		$Inet_addr = {((3a 97 17 f8) | (f8 17 97 3a))}
		$WSAStartup = {((31 a9 43 de) | (de 43 a9 31))}
		$Bind = {((50 96 0d fc) | (fc 0d 96 50))}
		$GetTempFileNameA = {((65 27 74 92) | (92 74 27 65))}
		$CreateMutexExA = {((65 4e 64 1b) | (1b 64 4e 65))}
		$DeviceIoControl = {((2e 3d 88 ed) | (ed 88 3d 2e))}
		$CryptDestroyHash = {((71 af fb 53) | (53 fb af 71))}
		$CryptEncrypt = {((3b f3 b1 c3) | (c3 b1 f3 3b))}
		$NtSetContextThread = {((5c 13 73 8b) | (8b 73 13 5c))}
		$CryptReleaseContext = {((41 a3 1b 02) | (02 1b a3 41))}
		$StretchBlt = {((27 30 1b 91) | (91 1b 30 27))}
		$NtWaitForSingleObject = {((34 48 e1 20) | (20 e1 48 34))}
		$LoadLibraryExA = {((4b 9a 7e d8) | (d8 7e 9a 4b))}
		$PeekMessageA = {((7c 60 70 45) | (45 70 60 7c))}
		$WNetAddConnectionA = {((04 c8 8d d9) | (d9 8d c8 04))}
		$NtCreateThread = {((64 73 0c 2c) | (2c 0c 73 64))}
		$ShellExecuteExA = {((3e 9b 15 67) | (67 15 9b 3e))}
		$GetMessageA = {((37 6a c0 70) | (70 c0 6a 37))}
		$GetCurrentHwProfileA = {((23 5d 75 a5) | (a5 75 5d 23))}
		$PostThreadMessageA = {((3c 4b 62 d3) | (d3 62 4b 3c))}
		$RegOpenKeyExA = {((20 c9 39 92) | (92 39 c9 20))}
		$CreateWaitableTimer = {((1c 96 be 6f) | (6f be 96 1c))}
		$NtSetInformationProcess = {((39 be 6f ab) | (ab 6f be 39))}
		$InternetSetOptionA = {((29 9a 2e 51) | (51 2e 9a 29))}
		$GetClipboardData = {((30 f0 90 7f) | (7f 90 f0 30))}
		$HttpSendRequestExA = {((7e 33 e5 5e) | (5e e5 33 7e))}
		$CreateProcessA = {((45 31 b3 07) | (07 b3 31 45))}
		$CreateToolhelp32Snapshot = {((5f 71 83 a5) | (a5 83 71 5f))}
		$GetProcessHeap = {((63 3c bc 0a) | (0a bc 3c 63))}
		$MapVirtualKeyExA = {((7d d8 7b ad) | (ad 7b d8 7d))}
		$NtTerminateProcess = {((67 6a 7a be) | (be 7a 6a 67))}
		$CallNextHookEx = {((62 0b 88 3b) | (3b 88 0b 62))}
		$TerminateProcess = {((75 cb 5e c8) | (c8 5e cb 75))}
		$GetIpNetTable = {((63 8c 71 91) | (91 71 8c 63))}
		$SetThreadToken = {((76 08 5f cb) | (cb 5f 08 76))}
		$SetCurrentDirectory = {((3f ec 2c a6) | (a6 2c ec 3f))}
		$GetFileTime = {((35 fe d6 23) | (23 d6 fe 35))}
		$CreateRemoteThread = {((00 9b 2f 79) | (79 2f 9b 00))}
		$KeInsertQueueApc = {((57 04 f6 ce) | (ce f6 04 57))}
		$SetWindowsHookExA = {((29 d6 0e 81) | (81 0e d6 29))}
		$EnumWindows = {((41 bc b4 57) | (57 b4 bc 41))}
		$NtSetSystemEnvironmentValueEx = {((0f c8 df ac) | (ac df c8 0f))}
		$GetKeynameTextA = {((14 5c 73 8b) | (8b 73 5c 14))}
		$CryptCreateHash = {((46 85 67 f1) | (f1 67 85 46))}
		$CreateThread = {((09 31 cd ec) | (ec cd 31 09))}
		$GetCurrentThread = {((5d 0c 5b 69) | (69 5b 0c 5d))}
		$EnumResourceTypesExA = {((2a 66 7e 39) | (39 7e 66 2a))}
		$OpenSCManagerA = {((1d 61 98 57) | (57 98 61 1d))}
		$NtWriteVirtualMemory = {((68 5a 22 5d) | (5d 22 5a 68))}
		$WSASocketA = {((53 d2 30 20) | (20 30 d2 53))}
		$SetWindowLongPtrA = {((4f 06 4a 4e) | (4e 4a 06 4f))}
		$CryptAcquireContextA = {((6e 7b e6 a1) | (a1 e6 7b 6e))}
		$Thread32Next = {((15 ae a8 0e) | (0e a8 ae 15))}
		$RegisterRawInputDevices = {((43 2d 83 5f) | (5f 83 2d 43))}
		$Gethostbyname = {((27 4e ea 41) | (41 ea 4e 27))}
		$GetLogicalProcessorInformationEx = {((06 81 a9 ba) | (ba a9 81 06))}
		$CreateWindowExA = {((10 ff db a5) | (a5 db ff 10))}
		$GetTickCount64 = {((55 bf 25 4d) | (4d 25 bf 55))}
		$SendMessageCallbackA = {((3a c0 ba 75) | (75 ba c0 3a))}
		$WNetAddConnection2A = {((1f bd 7e 7e) | (7e 7e bd 1f))}
		$ShellExecuteA = {((5a 3c 2e 95) | (95 2e 3c 5a))}
		$CryptGenRandom = {((48 48 ba ce) | (ce ba 48 48))}
		$RegConnectRegistryA = {((52 6e 2c c4) | (c4 2c 6e 52))}
		$CryptBinaryToString = {((65 f2 00 5d) | (5d 00 f2 65))}
		$RtlMoveMemory = {((3e ab 17 67) | (67 17 ab 3e))}
		$CopyFile2 = {((59 df 7b fc) | (fc 7b df 59))}
		$TimeGetTime = {((22 9e 87 01) | (01 87 9e 22))}
		$Thread32First = {((2a e6 4b 3d) | (3d 4b e6 2a))}
		$PostMessageA = {((1f b8 ac 4d) | (4d ac b8 1f))}
		$WSACleanup = {((73 5d e6 f8) | (f8 e6 5d 73))}
		$NtShutdownSystem = {((33 16 e6 6e) | (6e e6 16 33))}
		$GetModuleFileNameA = {((3d d0 67 31) | (31 67 d0 3d))}
		$Socket = {((7d ec 8c 3b) | (3b 8c ec 7d))}
		$NtCreateUserProcess = {((1c 84 ea b3) | (b3 ea 84 1c))}
		$GetCurrentProcessId = {((65 d4 99 c2) | (c2 99 d4 65))}
		$InternetCloseHandle = {((52 4e 94 a7) | (a7 94 4e 52))}
		$OpenFileMappingA = {((63 34 15 d9) | (d9 15 34 63))}
		$NtQueryDirectoryFile = {((74 be 6e a5) | (a5 6e be 74))}
		$GetAdaptersInfo = {((05 d2 ba 32) | (32 ba d2 05))}
		$MapViewOfFile = {((49 ca 5d 80) | (80 5d ca 49))}
		$TerminateThread = {((58 4a 24 3c) | (3c 24 4a 58))}
		$ControlServiceExA = {((6b f3 ee 0a) | (0a ee f3 6b))}
		$CreateProcessInternal = {((2d 5e 40 3e) | (3e 40 5e 2d))}
		$CreateMutexA = {((20 b6 ed c0) | (c0 ed b6 20))}
		$WSAIoctl = {((3d 21 b4 56) | (56 b4 21 3d))}
		$RegOpenKeyTransactedA = {((18 fd e6 31) | (31 e6 fd 18))}
		$Connect = {((45 24 25 94) | (94 25 24 45))}
		$RegQueryInfoKeyA = {((6f a6 22 99) | (99 22 a6 6f))}
		$RegSetKeySecurity = {((13 cc f3 ab) | (ab f3 cc 13))}
		$NtClose = {((5a c3 02 00) | (00 02 c3 5a))}
		$Sleep = {((7a 62 33 49) | (49 33 62 7a))}
		$NtProtectVirtualMemory = {((36 70 cd a4) | (a4 cd 70 36))}
		$NtReadVirtualMemory = {((09 16 fc 82) | (82 fc 16 09))}
		$Gethostname = {((3e a3 24 fe) | (fe 24 a3 3e))}
		$CopyFileExA = {((3f 95 ec 22) | (22 ec 95 3f))}
		$Wow64SetThreadContext = {((07 34 45 07) | (07 45 34 07))}
		$EnumProcessModulesEx = {((39 bd bf 02) | (02 bf bd 39))}
		$GetSystemDirectoryA = {((3e 61 7a f3) | (f3 7a 61 3e))}
		$NtCreateProcess = {((6c cc b2 e1) | (e1 b2 cc 6c))}
		$SetThreadContext = {((72 01 b1 04) | (04 b1 01 72))}
		$DnsQueryEx = {((30 dd d4 d8) | (d8 d4 dd 30))}
		$LoadResource = {((08 c1 47 ee) | (ee 47 c1 08))}
		$NtAllocateVirtualMemory = {((52 3d 59 83) | (83 59 3d 52))}
		$ConnectNamedPipe = {((1a 73 a4 ba) | (ba a4 73 1a))}
		$RegDeleteKeyValueA = {((7b 4e ce f2) | (f2 ce 4e 7b))}
		$CreatePipe = {((11 27 73 51) | (51 73 27 11))}
		$NtDelayExecution = {((3a 60 5a 09) | (09 5a 60 3a))}
		$RtlGetVersion = {((53 5c 3e d2) | (d2 3e 5c 53))}
		$NtOpenThread = {((21 f0 f5 62) | (62 f5 f0 21))}
		$RegReplaceKeyA = {((14 bc d6 e5) | (e5 d6 bc 14))}
		$RtlCreateHeap = {((70 cd df 45) | (45 df cd 70))}
		$CheckRemoteDebuggerPresent = {((34 b9 3c cf) | (cf 3c b9 34))}
		$GetProcessIdOfThread = {((4b 61 ea e0) | (e0 ea 61 4b))}
		$SetForegroundWindow = {((04 81 57 9e) | (9e 57 81 04))}
		$SetWinEventHook = {((7b f4 93 f6) | (f6 93 f4 7b))}
		$RegisterHotKey = {((15 95 9b c7) | (c7 9b 95 15))}
		$NtQueryInformationProcess = {((0f c2 f1 b1) | (b1 f1 c2 0f))}
		$CreateRemoteThreadEx = {((50 95 82 d3) | (d3 82 95 50))}
		$OpenClipboard = {((2a ab ad 96) | (96 ad ab 2a))}
		$RegEnumValueA = {((3e 25 7f ad) | (ad 7f 25 3e))}
		$URLDownloadToCacheFile = {((55 38 4a e4) | (e4 4a 38 55))}
		$LocalAlloc = {((65 59 c5 eb) | (eb c5 59 65))}
		$ShowWindow = {((40 ac de 1d) | (1d de ac 40))}
		$VirtualQueryEx = {((24 fd 50 a3) | (a3 50 fd 24))}
		$NtQueueApcThread = {((35 11 ed a8) | (a8 ed 11 35))}
		$NtMakeTemporaryObject = {((3e a7 90 2f) | (2f 90 a7 3e))}
		$VirtualAllocExNuma = {((74 0f dc af) | (af dc 0f 74))}
		$RegOpenKeyA = {((78 82 f8 c6) | (c6 f8 82 78))}
		$EnumDesktopWindows = {((0b cf ab 57) | (57 ab cf 0b))}
		$WaitForSingleObject = {((11 e9 95 f2) | (f2 95 e9 11))}
		$FindResourceExA = {((5f 34 bb 71) | (71 bb 34 5f))}
		$CryptStringToBinary = {((10 9a b5 6a) | (6a b5 9a 10))}
		$RegEnumKeyA = {((62 8a 85 79) | (79 85 8a 62))}
		$Select = {((5a 6f 3a 8a) | (8a 3a 6f 5a))}
		$WNetEnumResourceA = {((73 4a 1a d3) | (d3 1a 4a 73))}
		$EnumProcesses = {((1a 71 28 da) | (da 28 71 1a))}
		$Listen = {((33 02 ed 7a) | (7a ed 02 33))}
		$RegCreateKeyA = {((70 05 20 7e) | (7e 20 05 70))}
		$IsDebuggerPresent = {((4a 1c 23 81) | (81 23 1c 4a))}
		$FindNextUrlCacheEntryA = {((28 1e 08 6e) | (6e 08 1e 28))}
		$StartServiceA = {((31 d2 26 c8) | (c8 26 d2 31))}
		$GetThreadContext = {((31 48 d5 ec) | (ec d5 48 31))}
		$VirtualAlloc = {((3f 93 c3 16) | (16 c3 93 3f))}
		$Module32First = {((43 df f0 92) | (92 f0 df 43))}
		$FindFirstUrlCacheEntryA = {((37 d5 04 5f) | (5f 04 d5 37))}
		$SleepEx = {((3f 0f 87 ef) | (ef 87 0f 3f))}
		$MoveFileA = {((4f d9 d1 4b) | (4b d1 d9 4f))}
		$NtSetValueKey = {((1f 97 50 78) | (78 50 97 1f))}
		$SetWindowLongA = {((61 57 8e ed) | (ed 8e 57 61))}
		$MapViewOfFileEx = {((10 91 2c 77) | (77 2c 91 10))}
		$NtDuplicateObject = {((4c d6 86 4e) | (4e 86 d6 4c))}
		$GetKeyboardState = {((50 23 3b fc) | (fc 3b 23 50))}
		$GetSystemTime = {((12 46 d7 ba) | (ba d7 46 12))}
		$FindWindowExA = {((6a 6a 65 04) | (04 65 6a 6a))}
		$RegQueryMultipleValuesA = {((53 ec fc 04) | (04 fc ec 53))}
		$DrawTextExA = {((4d fb 2a 90) | (90 2a fb 4d))}
		$RegEnumKeyExA = {((43 e3 b2 9e) | (9e b2 e3 43))}
		$QueueUserAPC = {((72 37 e4 c5) | (c5 e4 37 72))}
		$RegSaveKeyA = {((59 87 65 2c) | (2c 65 87 59))}
		$CreateFileMappingA = {((38 27 4b c8) | (c8 4b 27 38))}
		$CryptDestroyKey = {((31 d4 1a ce) | (ce 1a d4 31))}
		$RegDeleteKeyExA = {((3e 35 11 ba) | (ba 11 35 3e))}
		$EnumResourceTypesA = {((29 33 00 a9) | (a9 00 33 29))}
		$RegSetKeyValueA = {((06 f1 01 54) | (54 01 f1 06))}
		$timeSetEvent = {((61 b8 6b e3) | (e3 6b b8 61))}
		$RegSaveKeyExA = {((02 07 f4 0e) | (0e f4 07 02))}
		$CountClipboardFormats = {((15 62 94 0f) | (0f 94 62 15))}
		$HttpAddRequestHeaders = {((75 c2 ff f2) | (f2 ff c2 75))}
		$NtQueueApcThreadEx2 = {((69 9c a2 57) | (57 a2 9c 69))}
		$RegCopyTreeA = {((20 b8 3f 73) | (73 3f b8 20))}
		$ImpersonateLoggedOnUser = {((10 90 1a d9) | (d9 1a 90 10))}
		$GetDriveTypeA = {((76 56 0a a2) | (a2 0a 56 76))}
		$GetVersionExA = {((49 38 1a 98) | (98 1a 38 49))}
		$InternetReadFile = {((2d e0 68 c3) | (c3 68 e0 2d))}
		$RegOpenCurrentUser = {((34 74 5d ff) | (ff 5d 74 34))}
		$GetThreadLocale = {((35 1f 1b 76) | (76 1b 1f 35))}
		$NtUnmapViewOfSection = {((43 90 44 fb) | (fb 44 90 43))}
		$FindNextFileA = {((12 0f 5f 91) | (91 5f 0f 12))}
		$GetLogicalProcessorInformation = {((72 50 21 38) | (38 21 50 72))}
		$FlushEfsCache = {((00 74 ae d1) | (d1 ae 74 00))}
		$Closesocket = {((1c 35 df ce) | (ce df 35 1c))}
		$NetShareGetInfo = {((7b b4 88 3e) | (3e 88 b4 7b))}
		$GetModuleHandleA = {((39 ff 4e 7d) | (7d 4e ff 39))}
		$VirtualAlloc2FromApp = {((20 02 ee 16) | (16 ee 02 20))}
		$MoveFileExA = {((18 b1 13 f0) | (f0 13 b1 18))}
		$NtWaitForMultipleObjects = {((5b b5 1b 78) | (78 1b b5 5b))}
		$DeleteFileA = {((6f 9e 23 97) | (97 23 9e 6f))}
		$StartServiceCtrlDispatcherA = {((34 bc 5f 7f) | (7f 5f bc 34))}
		$HttpOpenRequestA = {((37 7c af 75) | (75 af 7c 37))}
		$GetThreadInformation = {((59 88 d5 bf) | (bf d5 88 59))}
		$NtDeleteKey = {((6e 8e e7 72) | (72 e7 8e 6e))}
		$InternetWriteFile = {((7c 0e 8d dc) | (dc 8d 0e 7c))}
		$LoadLibraryA = {((34 8d 4c fd) | (fd 4c 8d 34))}
		$RegQueryValueExA = {((0a bc e6 46) | (46 e6 bc 0a))}
		$NtCreateProcessEx = {((7d cb b5 1c) | (1c b5 cb 7d))}
		$GetForegroundWindow = {((79 73 7d e6) | (e6 7d 73 79))}
		$NtQuerySystemEnvironmentValueEx = {((51 df 20 c8) | (c8 20 df 51))}
		$SizeOfResource = {((2d 92 c7 08) | (08 c7 92 2d))}
		$RegGetValueA = {((02 94 d8 88) | (88 d8 94 02))}
		$LdrLoadDll = {((73 96 f2 d2) | (d2 f2 96 73))}
		$NtResumeThread = {((63 9c 13 4f) | (4f 13 9c 63))}
		$MapViewOfFile3 = {((3b b7 e9 fc) | (fc e9 b7 3b))}
		$NtQueryTimer = {((59 49 be df) | (df be 49 59))}
		$RtlCopyMemory = {((48 d5 08 3a) | (3a 08 d5 48))}
		$InternetConnectA = {((1e 96 5b 9e) | (9e 5b 96 1e))}
		$SetClipboardData = {((73 b9 f4 97) | (97 f4 b9 73))}
		$GetKeyState = {((34 23 72 0d) | (0d 72 23 34))}
		$WriteProcessMemory = {((53 02 db 5b) | (5b db 02 53))}
		$RtlSetProcessIsCritical = {((5f 67 00 3e) | (3e 00 67 5f))}
		$NetShareAdd = {((11 7d 3a 8d) | (8d 3a 7d 11))}
		$NtResumeProcess = {((55 37 ce 53) | (53 ce 37 55))}
		$GetProcessHeaps = {((35 35 63 3c) | (3c 63 35 35))}
		$RegDeleteKeyTransactedA = {((63 4b 34 3f) | (3f 34 4b 63))}
		$ReadProcessMemory = {((3d 3f 42 a9) | (a9 42 3f 3d))}
		$GetNativeSystemInfo = {((4d 45 3f 22) | (22 3f 45 4d))}
		$ioctlsocket = {((0f 50 46 d1) | (d1 46 50 0f))}
		$CreateProcessAsUserA = {((35 44 d3 79) | (79 d3 44 35))}
		$PeekNamedPipe = {((26 37 30 b6) | (b6 30 37 26))}
		$SuspendThread = {((61 41 bf 69) | (69 bf 41 61))}
		$CallWindowProcA = {((33 f3 1b a2) | (a2 1b f3 33))}
		$OpenServiceA = {((09 ae 85 2b) | (2b 85 ae 09))}
		$SetTimer = {((10 81 f5 25) | (25 f5 81 10))}
		$MapViewOfFile2 = {((3b b7 e9 fd) | (fd e9 b7 3b))}
		$RegRestoreKeyA = {((39 38 4e 47) | (47 4e 38 39))}
		$InternetOpenUrlA = {((2a d5 b5 6e) | (6e b5 d5 2a))}
		$GetTempPathA = {((17 0a b4 02) | (02 b4 0a 17))}
		$NtAdjustPrivilegesToken = {((20 83 fd 66) | (66 fd 83 20))}
		$GetTickCount = {((1c 08 c9 b5) | (b5 c9 08 1c))}
		$RegSetValueExA = {((6c 99 b2 7c) | (7c b2 99 6c))}
		$NtCreateSection = {((16 bd 32 58) | (58 32 bd 16))}
		$SetPropA = {((5d 4f 63 82) | (82 63 4f 5d))}
		$GetModuleFileNameExA = {((1c 89 35 87) | (87 35 89 1c))}
		$PathFileExistsA = {((15 29 e6 ac) | (ac e6 29 15))}
		$SetFocus = {((33 cc 26 c0) | (c0 26 cc 33))}
		$GetDCEx = {((4a c7 c9 4d) | (4d c9 c7 4a))}
		$WNetOpenEnumA = {((5c f7 cc 39) | (39 cc f7 5c))}
		$FindFirstFileA = {((6a 3b bb 91) | (91 bb 3b 6a))}
		$AttachThreadInput = {((57 b0 60 5b) | (5b 60 b0 57))}
		$AdjustTokenPrivileges = {((15 b1 5c 78) | (78 5c b1 15))}
		$EnumProcessModules = {((77 17 13 1b) | (1b 13 17 77))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

425658e8-96e4-425d-848b-8b1a7fb33c85
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
