api_hashes_crc32_mpeg_2

YARA detection rule by filescanio
Rule api_hashes_crc32_mpeg_2 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_crc32_mpeg_2 : hardened
{
	strings:
		$ControlService = {((b1 b6 45 72) | (72 45 b6 b1))}
		$HttpSendRequestA = {((a2 39 01 73) | (73 01 39 a2))}
		$SetThreadPriority = {((c4 af 49 1a) | (1a 49 af c4))}
		$Recv = {((ff a1 b2 03) | (03 b2 a1 ff))}
		$QueryPerformanceFrequency = {((ed 65 45 55) | (55 45 65 ed))}
		$RegDeleteValueA = {((2a d7 c7 01) | (01 c7 d7 2a))}
		$GetWindowsDirectoryA = {((9b 64 d2 69) | (69 d2 64 9b))}
		$CryptSetKeyParam = {((5c 25 4a 9d) | (9d 4a 25 5c))}
		$RegCreateKeyExA = {((6c 4f da 31) | (31 da 4f 6c))}
		$Module32Next = {((8b ab 10 d9) | (d9 10 ab 8b))}
		$RegOpenUserClassesRoot = {((eb ec eb ca) | (ca eb ec eb))}
		$NtReadVirtualMemoryEx = {((6c 7e 9f f4) | (f4 9f 7e 6c))}
		$InternetOpenA = {((19 7b 7b f4) | (f4 7b 7b 19))}
		$URLOpenBlockingStream = {((5b 9c 06 a3) | (a3 06 9c 5b))}
		$NtSetInformationThread = {((85 58 c5 cf) | (cf c5 58 85))}
		$CreateFileA = {((35 8b ec f8) | (f8 ec 8b 35))}
		$UnhookWindowsHookEx = {((01 5f 75 38) | (38 75 5f 01))}
		$GetCurrentThreadId = {((82 c0 0b 31) | (31 0b c0 82))}
		$Accept = {((bd 62 69 ed) | (ed 69 62 bd))}
		$HeapReAlloc = {((f5 60 7c e7) | (e7 7c 60 f5))}
		$WinExec = {((ef 58 76 c0) | (c0 76 58 ef))}
		$NtQueueApcThreadEx = {((96 d0 29 7d) | (7d 29 d0 96))}
		$VirtualAllocFromApp = {((ae 5b 76 3a) | (3a 76 5b ae))}
		$RegLoadKeyA = {((aa 77 e0 6d) | (6d e0 77 aa))}
		$OutputDebugStringA = {((26 8a 09 fa) | (fa 09 8a 26))}
		$GetFileAttributesA = {((34 a5 7c 72) | (72 7c a5 34))}
		$SetWaitableTimer = {((f5 ab 43 92) | (92 43 ab f5))}
		$SendMessageA = {((5e ab 28 7e) | (7e 28 ab 5e))}
		$RegUnLoadKeyA = {((8e ae c4 97) | (97 c4 ae 8e))}
		$SetEnvironmentVariableA = {((30 63 3f 32) | (32 3f 63 30))}
		$VirtualAlloc2 = {((85 d2 2c d8) | (d8 2c d2 85))}
		$CryptProtectData = {((4a d6 df 4f) | (4f df d6 4a))}
		$GetDesktopWindow = {((15 12 ee d2) | (d2 ee 12 15))}
		$RegGetKeySecurity = {((80 1d e4 d6) | (d6 e4 1d 80))}
		$GetDC = {((4b 2a 43 c7) | (c7 43 2a 4b))}
		$LookupPrivilegeValueA = {((be 5f e3 12) | (12 e3 5f be))}
		$CryptGetHashParam = {((89 08 f7 d6) | (d6 f7 08 89))}
		$HeapAlloc = {((60 b4 f2 14) | (14 f2 b4 60))}
		$RegCloseKey = {((1d cf 33 44) | (44 33 cf 1d))}
		$CryptHashData = {((4e 2d 3d 5e) | (5e 3d 2d 4e))}
		$GlobalAlloc = {((d8 08 6a cd) | (cd 6a 08 d8))}
		$RegOverridePredefKey = {((f3 3a c9 da) | (da c9 3a f3))}
		$EnumSystemLocalesA = {((8f a3 b8 b0) | (b0 b8 a3 8f))}
		$GetProcessId = {((15 56 02 46) | (46 02 56 15))}
		$RegLoadMUIStringA = {((62 b8 d9 99) | (99 d9 b8 62))}
		$SearchPathA = {((d4 f6 ba f1) | (f1 ba f6 d4))}
		$FindClose = {((61 c8 8b 82) | (82 8b c8 61))}
		$NtDeleteValueKey = {((33 61 e0 d4) | (d4 e0 61 33))}
		$URLDownloadToFile = {((9d 84 7b 90) | (90 7b 84 9d))}
		$Toolhelp32ReadProcessMemory = {((6a 20 ca 0e) | (0e ca 20 6a))}
		$GetProcAddress = {((f2 3b 57 6d) | (6d 57 3b f2))}
		$OpenProcessToken = {((cc 9e f7 ab) | (ab f7 9e cc))}
		$HeapCreate = {((ed bd 48 f6) | (f6 48 bd ed))}
		$UuidFromStringA = {((28 31 58 c2) | (c2 58 31 28))}
		$VirtualProtectEx = {((3e ab 0f ac) | (ac 0f ab 3e))}
		$GetSystemTimeAsFileTime = {((02 c9 b9 06) | (06 b9 c9 02))}
		$GetModuleBaseNameA = {((8a 9b 23 53) | (53 23 9b 8a))}
		$lstrcatA = {((38 84 e8 84) | (84 e8 84 38))}
		$SetFileAttributesA = {((08 cd 94 20) | (20 94 cd 08))}
		$FindResourceA = {((d9 7e 0e d7) | (d7 0e 7e d9))}
		$WaitForMultipleObjects = {((61 1c d7 8b) | (8b d7 1c 61))}
		$QueryPerformanceCounter = {((51 8c 09 61) | (61 09 8c 51))}
		$NtCreateThreadEx = {((42 a1 f0 0d) | (0d f0 a1 42))}
		$NtContinue = {((b4 69 dc ff) | (ff dc 69 b4))}
		$IsWoW64Process = {((0e c7 0a d3) | (d3 0a c7 0e))}
		$DnsQuery_A = {((a7 aa 3f 54) | (54 3f aa a7))}
		$VirtualProtectFromApp = {((c5 98 94 79) | (79 94 98 c5))}
		$GetAsyncKeyState = {((59 15 5c 25) | (25 5c 15 59))}
		$EncryptFileA = {((18 76 63 49) | (49 63 76 18))}
		$DuplicateToken = {((e6 32 57 07) | (07 57 32 e6))}
		$CryptDeriveKey = {((94 5f 32 3f) | (3f 32 5f 94))}
		$LockResource = {((0b 04 e7 50) | (50 e7 04 0b))}
		$ResumeThread = {((31 1d 9c 96) | (96 9c 1d 31))}
		$WaitForSingleObjectEx = {((ab 5f a0 d4) | (d4 a0 5f ab))}
		$NtSuspendProcess = {((84 dc 78 ab) | (ab 78 dc 84))}
		$NetShareCheck = {((81 a1 44 7a) | (7a 44 a1 81))}
		$OpenThread = {((dc d7 97 ce) | (ce 97 d7 dc))}
		$URLOpenStream = {((63 d8 28 d6) | (d6 28 d8 63))}
		$UnmapViewOfFile = {((57 d1 8e 89) | (89 8e d1 57))}
		$CreateFile2 = {((d8 7c d7 c6) | (c6 d7 7c d8))}
		$DeleteService = {((8d 3f ce 6c) | (6c ce 3f 8d))}
		$GetThreadId = {((42 f8 8a 63) | (63 8a f8 42))}
		$RegDeleteKeyA = {((87 9d 03 d7) | (d7 03 9d 87))}
		$CreateTimerQueueTimer = {((63 b4 f4 4e) | (4e f4 b4 63))}
		$SetProcessDEPPolicy = {((9d 41 89 03) | (03 89 41 9d))}
		$CreateServiceA = {((73 ca 89 75) | (75 89 ca 73))}
		$ExitWindowsEx = {((f3 54 bd 48) | (48 bd 54 f3))}
		$NtMapViewOfSection = {((af 33 db 38) | (38 db 33 af))}
		$NtTerminateThread = {((19 4f 43 ce) | (ce 43 4f 19))}
		$Process32First = {((72 96 71 98) | (98 71 96 72))}
		$RegCreateKeyTransactedA = {((dd 9b e8 71) | (71 e8 9b dd))}
		$GetUserNameA = {((9c 68 f2 68) | (68 f2 68 9c))}
		$MapVirtualKeyA = {((3e 9a c9 63) | (63 c9 9a 3e))}
		$WNetCloseEnum = {((61 aa 02 e2) | (e2 02 aa 61))}
		$InternetReadFileExA = {((31 4c f1 9c) | (9c f1 4c 31))}
		$GetComputerNameA = {((79 b1 12 33) | (33 12 b1 79))}
		$RegFlushKey = {((2c 0b 74 ae) | (ae 74 0b 2c))}
		$VirtualAllocEx = {((2c 22 1c d9) | (d9 1c 22 2c))}
		$GetSystemDefaultLangId = {((f6 84 b8 0a) | (0a b8 84 f6))}
		$SetFileTime = {((bf ef 45 8d) | (8d 45 ef bf))}
		$SendNotifyMessageA = {((bf 09 df ee) | (ee df 09 bf))}
		$LookupAccountNameA = {((14 4d 8c cf) | (cf 8c 4d 14))}
		$NetShareEnum = {((9d 12 8a e8) | (e8 8a 12 9d))}
		$IcmpSendEcho = {((b9 cd 98 06) | (06 98 cd b9))}
		$DebugActiveProcessStop = {((b0 ad 82 23) | (23 82 ad b0))}
		$NtCreateFile = {((4f eb 69 96) | (96 69 eb 4f))}
		$DecryptFileA = {((c2 97 7a bf) | (bf 7a 97 c2))}
		$GetRawInputData = {((04 9d 75 3e) | (3e 75 9d 04))}
		$BringWindowToTop = {((29 17 fc d8) | (d8 fc 17 29))}
		$NetShareSetInfo = {((da 1e e9 b7) | (b7 e9 1e da))}
		$GetLogicalDrives = {((e1 33 83 5d) | (5d 83 33 e1))}
		$WriteFile = {((f7 88 1c 58) | (58 1c 88 f7))}
		$BitBlt = {((49 5c 4b 2c) | (2c 4b 5c 49))}
		$SendMessageTimeoutA = {((22 c8 ae 55) | (55 ae c8 22))}
		$GetCurrentProcess = {((ce e9 9d df) | (df 9d e9 ce))}
		$RegDeleteTreeA = {((79 eb f2 26) | (26 f2 eb 79))}
		$CreateProcessWithTokenW = {((10 fd d9 7f) | (7f d9 fd 10))}
		$FindWindowA = {((32 49 cf 80) | (80 cf 49 32))}
		$CopyFileA = {((14 d4 22 86) | (86 22 d4 14))}
		$FtpPutFileA = {((4d c5 0d 78) | (78 0d c5 4d))}
		$NtOpenProcess = {((d7 87 27 18) | (18 27 87 d7))}
		$Send = {((7b 2a 6b 8d) | (8d 6b 2a 7b))}
		$EnumDeviceDrivers = {((40 10 fd d0) | (d0 fd 10 40))}
		$Process32Next = {((d9 4c 39 31) | (31 39 4c d9))}
		$GetWindowDC = {((16 16 f0 5b) | (5b f0 16 16))}
		$CryptDecrypt = {((4b c0 6f 1e) | (1e 6f c0 4b))}
		$ReadFile = {((27 9a d1 7a) | (7a d1 9a 27))}
		$VirtualProtect = {((f1 c2 5b 45) | (45 5b c2 f1))}
		$OpenProcess = {((35 eb fd ea) | (ea fd eb 35))}
		$WaitForMultipleObjectsEx = {((0d ad a7 c4) | (c4 a7 ad 0d))}
		$Inet_addr = {((68 f7 dd 54) | (54 dd f7 68))}
		$WSAStartup = {((ae 18 d0 af) | (af d0 18 ae))}
		$Bind = {((59 f4 0a bd) | (bd 0a f4 59))}
		$GetTempFileNameA = {((d4 94 69 52) | (52 69 94 d4))}
		$CreateMutexExA = {((2a 47 ae 1e) | (1e ae 47 2a))}
		$DeviceIoControl = {((af fe 78 05) | (05 78 fe af))}
		$CryptDestroyHash = {((f2 aa 0b a0) | (a0 0b aa f2))}
		$CryptEncrypt = {((f0 af 7b 47) | (47 7b af f0))}
		$NtSetContextThread = {((12 18 0b ff) | (ff 0b 18 12))}
		$CryptReleaseContext = {((19 61 3f 43) | (43 3f 61 19))}
		$StretchBlt = {((8c 4b 47 94) | (94 47 4b 8c))}
		$NtWaitForSingleObject = {((95 37 f5 ff) | (ff f5 37 95))}
		$LoadLibraryExA = {((c5 0e a5 76) | (76 a5 0e c5))}
		$PeekMessageA = {((9d 82 ea e7) | (e7 ea 82 9d))}
		$WNetAddConnectionA = {((1e 8b bd d2) | (d2 bd 8b 1e))}
		$NtCreateThread = {((70 e5 f1 be) | (be f1 e5 70))}
		$ShellExecuteExA = {((3b 54 9d f7) | (f7 9d 54 3b))}
		$GetMessageA = {((2d ab b1 6a) | (6a b1 ab 2d))}
		$GetCurrentHwProfileA = {((d3 3d e1 01) | (01 e1 3d d3))}
		$PostThreadMessageA = {((12 c6 1b 62) | (62 1b c6 12))}
		$RegOpenKeyExA = {((19 f5 6f 07) | (07 6f f5 19))}
		$CreateWaitableTimer = {((ac 85 f8 2f) | (2f f8 85 ac))}
		$NtSetInformationProcess = {((e0 e7 a7 e2) | (e2 a7 e7 e0))}
		$InternetSetOptionA = {((5c 1f d8 74) | (74 d8 1f 5c))}
		$GetClipboardData = {((30 9e b8 7a) | (7a b8 9e 30))}
		$HttpSendRequestExA = {((39 8c b0 d9) | (d9 b0 8c 39))}
		$CreateProcessA = {((0e 8f 55 80) | (80 55 8f 0e))}
		$CreateToolhelp32Snapshot = {((a3 66 93 01) | (01 93 66 a3))}
		$GetProcessHeap = {((69 c6 2d b2) | (b2 2d c6 69))}
		$MapVirtualKeyExA = {((50 41 e1 7e) | (7e e1 41 50))}
		$NtTerminateProcess = {((e7 70 06 18) | (18 06 70 e7))}
		$CallNextHookEx = {((0e 19 12 06) | (06 12 19 0e))}
		$TerminateProcess = {((1a fd df 0c) | (0c df fd 1a))}
		$GetIpNetTable = {((ee 96 65 60) | (60 65 96 ee))}
		$SetThreadToken = {((4b 34 93 49) | (49 93 34 4b))}
		$SetCurrentDirectory = {((07 85 d9 75) | (75 d9 85 07))}
		$GetFileTime = {((f6 99 bf b1) | (b1 bf 99 f6))}
		$CreateRemoteThread = {((d5 f8 6f 96) | (96 6f f8 d5))}
		$KeInsertQueueApc = {((53 74 ca c4) | (c4 ca 74 53))}
		$SetWindowsHookExA = {((a6 4d 38 14) | (14 38 4d a6))}
		$EnumWindows = {((64 97 b1 16) | (16 b1 97 64))}
		$NtSetSystemEnvironmentValueEx = {((46 7d 3b 50) | (50 3b 7d 46))}
		$GetKeynameTextA = {((ee 55 60 46) | (46 60 55 ee))}
		$CryptCreateHash = {((81 48 79 33) | (33 79 48 81))}
		$CreateThread = {((d0 14 1e a9) | (a9 1e 14 d0))}
		$GetCurrentThread = {((08 2e 0a 93) | (93 0a 2e 08))}
		$EnumResourceTypesExA = {((82 d3 bd c9) | (c9 bd d3 82))}
		$OpenSCManagerA = {((84 2c a2 df) | (df a2 2c 84))}
		$NtWriteVirtualMemory = {((0e 5b b5 4e) | (4e b5 5b 0e))}
		$WSASocketA = {((b2 50 53 d8) | (d8 53 50 b2))}
		$SetWindowLongPtrA = {((f5 d0 8e ec) | (ec 8e d0 f5))}
		$CryptAcquireContextA = {((af b6 e6 91) | (91 e6 b6 af))}
		$Thread32Next = {((ba 1a 67 8f) | (8f 67 1a ba))}
		$RegisterRawInputDevices = {((04 27 a9 0d) | (0d a9 27 04))}
		$Gethostbyname = {((3d bf 36 cb) | (cb 36 bf 3d))}
		$GetLogicalProcessorInformationEx = {((db 22 fc 5d) | (5d fc 22 db))}
		$CreateWindowExA = {((2a cd 6c 64) | (64 6c cd 2a))}
		$GetTickCount64 = {((09 1c a8 8f) | (8f a8 1c 09))}
		$SendMessageCallbackA = {((4e 56 f7 68) | (68 f7 56 4e))}
		$WNetAddConnection2A = {((c8 3a 5a 10) | (10 5a 3a c8))}
		$ShellExecuteA = {((41 30 b0 e0) | (e0 b0 30 41))}
		$CryptGenRandom = {((a4 ab 13 9d) | (9d 13 ab a4))}
		$RegConnectRegistryA = {((19 bc 4e 49) | (49 4e bc 19))}
		$CryptBinaryToString = {((cc 95 35 ba) | (ba 35 95 cc))}
		$RtlMoveMemory = {((24 16 d0 09) | (09 d0 16 24))}
		$CopyFile2 = {((f9 23 19 b8) | (b8 19 23 f9))}
		$TimeGetTime = {((85 66 48 af) | (af 48 66 85))}
		$Thread32First = {((85 2e 2f d6) | (d6 2f 2e 85))}
		$PostMessageA = {((d9 9d ef 0e) | (0e ef 9d d9))}
		$WSACleanup = {((80 02 6f 9c) | (9c 6f 02 80))}
		$NtShutdownSystem = {((30 3c 08 8e) | (8e 08 3c 30))}
		$GetModuleFileNameA = {((e6 78 f8 c6) | (c6 f8 78 e6))}
		$Socket = {((d1 14 c9 e3) | (e3 c9 14 d1))}
		$NtCreateUserProcess = {((b7 70 d9 7c) | (7c d9 70 b7))}
		$GetCurrentProcessId = {((70 5d c0 df) | (df c0 5d 70))}
		$InternetCloseHandle = {((42 6c 48 99) | (99 48 6c 42))}
		$OpenFileMappingA = {((47 a5 5d 16) | (16 5d a5 47))}
		$NtQueryDirectoryFile = {((4b d8 0f 57) | (57 0f d8 4b))}
		$GetAdaptersInfo = {((2e 1e 77 9c) | (9c 77 1e 2e))}
		$MapViewOfFile = {((9b f7 f1 5c) | (5c f1 f7 9b))}
		$TerminateThread = {((05 cb d3 57) | (57 d3 cb 05))}
		$ControlServiceExA = {((76 d0 b6 30) | (30 b6 d0 76))}
		$CreateProcessInternal = {((ec 8d d9 10) | (10 d9 8d ec))}
		$CreateMutexA = {((08 f6 ff e8) | (e8 ff f6 08))}
		$WSAIoctl = {((a6 e4 31 57) | (57 31 e4 a6))}
		$RegOpenKeyTransactedA = {((70 3c 49 51) | (51 49 3c 70))}
		$Connect = {((bb 47 f9 7a) | (7a f9 47 bb))}
		$RegQueryInfoKeyA = {((54 9c da 30) | (30 da 9c 54))}
		$RegSetKeySecurity = {((f7 7b 58 a9) | (a9 58 7b f7))}
		$NtClose = {((3e 56 4b 9d) | (9d 4b 56 3e))}
		$Sleep = {((fa 12 14 b1) | (b1 14 12 fa))}
		$NtProtectVirtualMemory = {((4f c2 10 75) | (75 10 c2 4f))}
		$NtReadVirtualMemory = {((17 35 98 d0) | (d0 98 35 17))}
		$Gethostname = {((b5 9c df d3) | (d3 df 9c b5))}
		$CopyFileExA = {((b9 b5 da 78) | (78 da b5 b9))}
		$Wow64SetThreadContext = {((0c bf e4 2a) | (2a e4 bf 0c))}
		$EnumProcessModulesEx = {((1c 26 ed 6f) | (6f ed 26 1c))}
		$GetSystemDirectoryA = {((f4 bc 27 aa) | (aa 27 bc f4))}
		$NtCreateProcess = {((c3 ae 40 80) | (80 40 ae c3))}
		$SetThreadContext = {((a5 ed b2 36) | (36 b2 ed a5))}
		$DnsQueryEx = {((6b ba e4 85) | (85 e4 ba 6b))}
		$LoadResource = {((57 27 d5 40) | (40 d5 27 57))}
		$NtAllocateVirtualMemory = {((c8 a5 7a 19) | (19 7a a5 c8))}
		$ConnectNamedPipe = {((69 8b 33 ad) | (ad 33 8b 69))}
		$RegDeleteKeyValueA = {((8d 85 e8 06) | (06 e8 85 8d))}
		$CreatePipe = {((62 85 fa 20) | (20 fa 85 62))}
		$NtDelayExecution = {((e8 07 05 e3) | (e3 05 07 e8))}
		$RtlGetVersion = {((4c 9a f8 b9) | (b9 f8 9a 4c))}
		$NtOpenThread = {((19 7f b4 ef) | (ef b4 7f 19))}
		$RegReplaceKeyA = {((ff da 79 3b) | (3b 79 da ff))}
		$RtlCreateHeap = {((ff 4a bc 23) | (23 bc 4a ff))}
		$CheckRemoteDebuggerPresent = {((8a 82 b3 6e) | (6e b3 82 8a))}
		$GetProcessIdOfThread = {((a5 da 89 fd) | (fd 89 da a5))}
		$SetForegroundWindow = {((9e ee e9 5d) | (5d e9 ee 9e))}
		$SetWinEventHook = {((47 29 11 4d) | (4d 11 29 47))}
		$RegisterHotKey = {((36 59 40 26) | (26 40 59 36))}
		$NtQueryInformationProcess = {((50 3d 1a c7) | (c7 1a 3d 50))}
		$CreateRemoteThreadEx = {((94 47 a3 65) | (65 a3 47 94))}
		$OpenClipboard = {((df 2c e9 f3) | (f3 e9 2c df))}
		$RegEnumValueA = {((80 79 07 e9) | (e9 07 79 80))}
		$URLDownloadToCacheFile = {((4e b9 1a 29) | (29 1a b9 4e))}
		$LocalAlloc = {((e2 6f 4b 78) | (78 4b 6f e2))}
		$ShowWindow = {((f9 2a 0f 1a) | (1a 0f 2a f9))}
		$VirtualQueryEx = {((08 05 b1 4c) | (4c b1 05 08))}
		$NtQueueApcThread = {((27 93 b9 25) | (25 b9 93 27))}
		$NtMakeTemporaryObject = {((ef 09 00 1e) | (1e 00 09 ef))}
		$VirtualAllocExNuma = {((d1 d1 30 3b) | (3b 30 d1 d1))}
		$RegOpenKeyA = {((84 e8 f1 25) | (25 f1 e8 84))}
		$EnumDesktopWindows = {((81 8f bc 29) | (29 bc 8f 81))}
		$WaitForSingleObject = {((99 01 75 d5) | (d5 75 01 99))}
		$FindResourceExA = {((95 fe 4d 53) | (53 4d fe 95))}
		$CryptStringToBinary = {((94 e1 6d 74) | (74 6d e1 94))}
		$RegEnumKeyA = {((b8 08 16 d4) | (d4 16 08 b8))}
		$Select = {((08 4f 57 12) | (12 57 4f 08))}
		$WNetEnumResourceA = {((b5 b8 56 b2) | (b2 56 b8 b5))}
		$EnumProcesses = {((56 1c 2c ee) | (ee 2c 1c 56))}
		$Listen = {((cf e8 cd 3d) | (3d cd e8 cf))}
		$RegCreateKeyA = {((70 58 8f bd) | (bd 8f 58 70))}
		$IsDebuggerPresent = {((88 8a b1 9b) | (9b b1 8a 88))}
		$FindNextUrlCacheEntryA = {((8d d3 18 d1) | (d1 18 d3 8d))}
		$StartServiceA = {((b1 02 11 9a) | (9a 11 02 b1))}
		$GetThreadContext = {((e9 ca 86 10) | (10 86 ca e9))}
		$VirtualAlloc = {((98 5b 77 ac) | (ac 77 5b 98))}
		$Module32First = {((e4 aa 09 f1) | (f1 09 aa e4))}
		$FindFirstUrlCacheEntryA = {((49 85 ca 59) | (59 ca 85 49))}
		$SleepEx = {((98 67 58 c4) | (c4 58 67 98))}
		$MoveFileA = {((1b 84 1e 4f) | (4f 1e 84 1b))}
		$NtSetValueKey = {((0a d1 76 13) | (13 76 d1 0a))}
		$SetWindowLongA = {((46 5a a4 83) | (83 a4 5a 46))}
		$MapViewOfFileEx = {((1c 1a 8e 60) | (60 8e 1a 1c))}
		$NtDuplicateObject = {((a9 3d fb 8e) | (8e fb 3d a9))}
		$GetKeyboardState = {((c5 c2 69 4b) | (4b 69 c2 c5))}
		$GetSystemTime = {((57 bb 4f d0) | (d0 4f bb 57))}
		$FindWindowExA = {((85 16 ee b5) | (b5 ee 16 85))}
		$RegQueryMultipleValuesA = {((88 c9 b7 08) | (08 b7 c9 88))}
		$DrawTextExA = {((49 0c 0a fe) | (fe 0a 0c 49))}
		$RegEnumKeyExA = {((c4 33 86 b0) | (b0 86 33 c4))}
		$QueueUserAPC = {((19 0b 4e 16) | (16 4e 0b 19))}
		$RegSaveKeyA = {((3f 18 08 bc) | (bc 08 18 3f))}
		$CreateFileMappingA = {((e9 58 67 56) | (56 67 58 e9))}
		$CryptDestroyKey = {((e3 fd 42 fd) | (fd 42 fd e3))}
		$RegDeleteKeyExA = {((6e 9d 46 58) | (58 46 9d 6e))}
		$EnumResourceTypesA = {((54 18 30 20) | (20 30 18 54))}
		$RegSetKeyValueA = {((bb 1d 78 32) | (32 78 1d bb))}
		$timeSetEvent = {((fc b6 bc d0) | (d0 bc b6 fc))}
		$RegSaveKeyExA = {((23 09 fb 22) | (22 fb 09 23))}
		$CountClipboardFormats = {((b8 32 3d 74) | (74 3d 32 b8))}
		$HttpAddRequestHeaders = {((fd 67 fc 02) | (02 fc 67 fd))}
		$NtQueueApcThreadEx2 = {((32 02 5d d2) | (d2 5d 02 32))}
		$RegCopyTreeA = {((d2 89 11 ce) | (ce 11 89 d2))}
		$ImpersonateLoggedOnUser = {((e1 55 86 3e) | (3e 86 55 e1))}
		$GetDriveTypeA = {((12 02 f4 5f) | (5f f4 02 12))}
		$GetVersionExA = {((7d 67 ac c3) | (c3 ac 67 7d))}
		$InternetReadFile = {((88 6e 0e 5a) | (5a 0e 6e 88))}
		$RegOpenCurrentUser = {((5a 49 65 aa) | (aa 65 49 5a))}
		$GetThreadLocale = {((39 0a 78 e6) | (e6 78 0a 39))}
		$NtUnmapViewOfSection = {((66 72 43 69) | (69 43 72 66))}
		$FindNextFileA = {((54 66 6f 8a) | (8a 6f 66 54))}
		$GetLogicalProcessorInformation = {((87 03 73 e5) | (e5 73 03 87))}
		$FlushEfsCache = {((a6 3c c9 9d) | (9d c9 3c a6))}
		$Closesocket = {((ba 28 2b 2d) | (2d 2b 28 ba))}
		$NetShareGetInfo = {((05 f0 a3 88) | (88 a3 f0 05))}
		$GetModuleHandleA = {((9f e4 fc e1) | (e1 fc e4 9f))}
		$VirtualAlloc2FromApp = {((85 85 66 58) | (58 66 85 85))}
		$MoveFileExA = {((40 6c 4c 57) | (57 4c 6c 40))}
		$NtWaitForMultipleObjects = {((fe 93 f3 d2) | (d2 f3 93 fe))}
		$DeleteFileA = {((67 f8 2b f4) | (f4 2b f8 67))}
		$StartServiceCtrlDispatcherA = {((23 e5 ce 79) | (79 ce e5 23))}
		$HttpOpenRequestA = {((b1 92 1a 5d) | (5d 1a 92 b1))}
		$GetThreadInformation = {((20 82 ee 38) | (38 ee 82 20))}
		$NtDeleteKey = {((9c c4 e6 0b) | (0b e6 c4 9c))}
		$InternetWriteFile = {((ca 37 d7 eb) | (eb d7 37 ca))}
		$LoadLibraryA = {((85 55 73 34) | (34 73 55 85))}
		$RegQueryValueExA = {((b5 e1 89 19) | (19 89 e1 b5))}
		$NtCreateProcessEx = {((2c c7 61 65) | (65 61 c7 2c))}
		$GetForegroundWindow = {((17 38 4d a9) | (a9 4d 38 17))}
		$NtQuerySystemEnvironmentValueEx = {((b9 0c 17 13) | (13 17 0c b9))}
		$SizeOfResource = {((49 f8 66 1e) | (1e 66 f8 49))}
		$RegGetValueA = {((87 94 75 0f) | (0f 75 94 87))}
		$LdrLoadDll = {((ed c1 14 e1) | (e1 14 c1 ed))}
		$NtResumeThread = {((91 ec 73 81) | (81 73 ec 91))}
		$MapViewOfFile3 = {((20 d6 e7 b6) | (b6 e7 d6 20))}
		$NtQueryTimer = {((e0 95 5c 85) | (85 5c 95 e0))}
		$RtlCopyMemory = {((4c 65 a4 b4) | (b4 a4 65 4c))}
		$InternetConnectA = {((4e 3f 8e ff) | (ff 8e 3f 4e))}
		$SetClipboardData = {((7c b9 8c 5c) | (5c 8c b9 7c))}
		$GetKeyState = {((06 eb 9c 0e) | (0e 9c eb 06))}
		$WriteProcessMemory = {((ee e1 99 74) | (74 99 e1 ee))}
		$RtlSetProcessIsCritical = {((a9 5a 4d 6e) | (6e 4d 5a a9))}
		$NetShareAdd = {((71 57 c6 e1) | (e1 c6 57 71))}
		$NtResumeProcess = {((0b 44 44 4e) | (4e 44 44 0b))}
		$GetProcessHeaps = {((a5 b6 bf a6) | (a6 bf b6 a5))}
		$RegDeleteKeyTransactedA = {((00 7d ad 39) | (39 ad 7d 00))}
		$ReadProcessMemory = {((ad bb 07 cb) | (cb 07 bb ad))}
		$GetNativeSystemInfo = {((8d f7 a1 81) | (81 a1 f7 8d))}
		$ioctlsocket = {((ab e4 a4 62) | (62 a4 e4 ab))}
		$CreateProcessAsUserA = {((97 e4 3c 56) | (56 3c e4 97))}
		$PeekNamedPipe = {((08 de b5 15) | (15 b5 de 08))}
		$SuspendThread = {((b6 25 ce 55) | (55 ce 25 b6))}
		$CallWindowProcA = {((68 73 25 c5) | (c5 25 73 68))}
		$OpenServiceA = {((65 08 5d ce) | (ce 5d 08 65))}
		$SetTimer = {((3f a1 6b cb) | (cb 6b a1 3f))}
		$MapViewOfFile2 = {((24 17 fa 01) | (01 fa 17 24))}
		$RegRestoreKeyA = {((ed 2c 31 ab) | (ab 31 2c ed))}
		$InternetOpenUrlA = {((e2 55 1f 18) | (18 1f 55 e2))}
		$GetTempPathA = {((24 eb af a3) | (a3 af eb 24))}
		$NtAdjustPrivilegesToken = {((c1 34 61 24) | (24 61 34 c1))}
		$GetTickCount = {((4a 6a f3 dd) | (dd f3 6a 4a))}
		$RegSetValueExA = {((73 fa 4c 6b) | (6b 4c fa 73))}
		$NtCreateSection = {((c4 03 35 ce) | (ce 35 03 c4))}
		$SetPropA = {((2c 70 86 ae) | (ae 86 70 2c))}
		$GetModuleFileNameExA = {((f4 1c 90 fc) | (fc 90 1c f4))}
		$PathFileExistsA = {((10 cc d0 74) | (74 d0 cc 10))}
		$SetFocus = {((f0 00 c7 8f) | (8f c7 00 f0))}
		$GetDCEx = {((5d 4c 6c 9d) | (9d 6c 4c 5d))}
		$WNetOpenEnumA = {((9a a4 69 69) | (69 69 a4 9a))}
		$FindFirstFileA = {((71 ad df c0) | (c0 df ad 71))}
		$AttachThreadInput = {((56 56 85 44) | (44 85 56 56))}
		$AdjustTokenPrivileges = {((4d 2a fe f4) | (f4 fe 2a 4d))}
		$EnumProcessModules = {((55 9f d7 99) | (99 d7 9f 55))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

fe12b23f-8f97-484e-9cd1-ec4c2432928e
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
