api_hashes_ror9AddHash32

YARA detection rule by filescanio
Rule api_hashes_ror9AddHash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_ror9AddHash32 : hardened
{
	strings:
		$ControlService = {((8a ee d1 12) | (12 d1 ee 8a))}
		$HttpSendRequestA = {((e8 e1 1c a7) | (a7 1c e1 e8))}
		$SetThreadPriority = {((a2 6a 52 7f) | (7f 52 6a a2))}
		$Recv = {((31 99 4a b6) | (b6 4a 99 31))}
		$QueryPerformanceFrequency = {((4e c3 42 46) | (46 42 c3 4e))}
		$RegDeleteValueA = {((30 f8 25 40) | (40 25 f8 30))}
		$GetWindowsDirectoryA = {((eb 02 9b ad) | (ad 9b 02 eb))}
		$CryptSetKeyParam = {((b5 9c 7f bf) | (bf 7f 9c b5))}
		$RegCreateKeyExA = {((56 10 aa 20) | (20 aa 10 56))}
		$Module32Next = {((72 e4 fa d9) | (d9 fa e4 72))}
		$RegOpenUserClassesRoot = {((bb 9a cc 68) | (68 cc 9a bb))}
		$NtReadVirtualMemoryEx = {((60 41 dc 95) | (95 dc 41 60))}
		$InternetOpenA = {((61 7d 80 30) | (30 80 7d 61))}
		$URLOpenBlockingStream = {((97 e0 0d aa) | (aa 0d e0 97))}
		$NtSetInformationThread = {((ea 49 15 f8) | (f8 15 49 ea))}
		$CreateFileA = {((fa fd ee e7) | (e7 ee fd fa))}
		$UnhookWindowsHookEx = {((c7 ea 47 ac) | (ac 47 ea c7))}
		$GetCurrentThreadId = {((1b ea 93 0e) | (0e 93 ea 1b))}
		$Accept = {((6a 21 4c da) | (da 4c 21 6a))}
		$HeapReAlloc = {((ab f6 e8 c7) | (c7 e8 f6 ab))}
		$WinExec = {((15 e7 65 0a) | (0a 65 e7 15))}
		$NtQueueApcThreadEx = {((23 2a 0e 68) | (68 0e 2a 23))}
		$VirtualAllocFromApp = {((2a 0c c0 50) | (50 c0 0c 2a))}
		$RegLoadKeyA = {((e6 d5 9a bf) | (bf 9a d5 e6))}
		$OutputDebugStringA = {((3c 26 c4 c0) | (c0 c4 26 3c))}
		$GetFileAttributesA = {((90 0d 70 92) | (92 70 0d 90))}
		$SetWaitableTimer = {((a2 72 ba 3c) | (3c ba 72 a2))}
		$SendMessageA = {((2a 6a 7a 4d) | (4d 7a 6a 2a))}
		$RegUnLoadKeyA = {((92 ed a0 0c) | (0c a0 ed 92))}
		$SetEnvironmentVariableA = {((fc 02 e0 d7) | (d7 e0 02 fc))}
		$VirtualAlloc2 = {((8e 3f 9b 08) | (08 9b 3f 8e))}
		$CryptProtectData = {((f9 6e bb a7) | (a7 bb 6e f9))}
		$GetDesktopWindow = {((70 cc 0d 7d) | (7d 0d cc 70))}
		$RegGetKeySecurity = {((57 0a af d2) | (d2 af 0a 57))}
		$GetDC = {((92 1d 0c e7) | (e7 0c 1d 92))}
		$LookupPrivilegeValueA = {((1f 72 83 c1) | (c1 83 72 1f))}
		$CryptGetHashParam = {((47 9e f4 82) | (82 f4 9e 47))}
		$HeapAlloc = {((93 1c 92 b1) | (b1 92 1c 93))}
		$RegCloseKey = {((cd 3f 12 26) | (26 12 3f cd))}
		$CryptHashData = {((76 19 eb c6) | (c6 eb 19 76))}
		$GlobalAlloc = {((ba 32 a4 6b) | (6b a4 32 ba))}
		$RegOverridePredefKey = {((33 99 c0 5f) | (5f c0 99 33))}
		$EnumSystemLocalesA = {((0b e6 63 a3) | (a3 63 e6 0b))}
		$GetProcessId = {((a7 f0 a4 f7) | (f7 a4 f0 a7))}
		$RegLoadMUIStringA = {((9d a7 d4 a3) | (a3 d4 a7 9d))}
		$SearchPathA = {((98 91 2e 0a) | (0a 2e 91 98))}
		$FindClose = {((b2 bd 86 bb) | (bb 86 bd b2))}
		$NtDeleteValueKey = {((0d 80 8c eb) | (eb 8c 80 0d))}
		$URLDownloadToFile = {((23 39 16 ae) | (ae 16 39 23))}
		$Toolhelp32ReadProcessMemory = {((03 eb a3 c7) | (c7 a3 eb 03))}
		$GetProcAddress = {((72 45 9f 8e) | (8e 9f 45 72))}
		$OpenProcessToken = {((7e 4f 61 68) | (68 61 4f 7e))}
		$HeapCreate = {((c1 56 0d ce) | (ce 0d 56 c1))}
		$UuidFromStringA = {((4d 09 95 23) | (23 95 09 4d))}
		$VirtualProtectEx = {((19 b8 73 b6) | (b6 73 b8 19))}
		$GetSystemTimeAsFileTime = {((d4 8a a7 41) | (41 a7 8a d4))}
		$GetModuleBaseNameA = {((e6 a0 50 eb) | (eb 50 a0 e6))}
		$lstrcatA = {((5d ba 19 80) | (80 19 ba 5d))}
		$SetFileAttributesA = {((90 0d 76 92) | (92 76 0d 90))}
		$FindResourceA = {((fc a4 b6 df) | (df b6 a4 fc))}
		$WaitForMultipleObjects = {((c1 bb 03 3c) | (3c 03 bb c1))}
		$QueryPerformanceCounter = {((07 1c 28 b2) | (b2 28 1c 07))}
		$NtCreateThreadEx = {((1e 86 df 64) | (64 df 86 1e))}
		$NtContinue = {((f2 34 4a 12) | (12 4a 34 f2))}
		$IsWoW64Process = {((4a 88 71 0d) | (0d 71 88 4a))}
		$DnsQuery_A = {((f1 69 93 6d) | (6d 93 69 f1))}
		$VirtualProtectFromApp = {((c5 91 1f da) | (da 1f 91 c5))}
		$GetAsyncKeyState = {((c3 2c a3 63) | (63 a3 2c c3))}
		$EncryptFileA = {((a8 6e 69 e0) | (e0 69 6e a8))}
		$DuplicateToken = {((e0 4b 5a 23) | (23 5a 4b e0))}
		$CryptDeriveKey = {((01 38 c9 fa) | (fa c9 38 01))}
		$LockResource = {((10 67 bf 7a) | (7a bf 67 10))}
		$ResumeThread = {((68 74 7c cf) | (cf 7c 74 68))}
		$WaitForSingleObjectEx = {((cc 22 f3 2d) | (2d f3 22 cc))}
		$NtSuspendProcess = {((9e af c3 81) | (81 c3 af 9e))}
		$NetShareCheck = {((71 cc b3 3e) | (3e b3 cc 71))}
		$OpenThread = {((23 62 87 75) | (75 87 62 23))}
		$URLOpenStream = {((28 aa 9a 89) | (89 9a aa 28))}
		$UnmapViewOfFile = {((28 92 b3 56) | (56 b3 92 28))}
		$CreateFile2 = {((fa fd ee d8) | (d8 ee fd fa))}
		$DeleteService = {((6d 36 37 03) | (03 37 36 6d))}
		$GetThreadId = {((ec 5d 3e f2) | (f2 3e 5d ec))}
		$RegDeleteKeyA = {((9a 7c f8 4c) | (4c f8 7c 9a))}
		$CreateTimerQueueTimer = {((aa 79 68 d8) | (d8 68 79 aa))}
		$SetProcessDEPPolicy = {((6e fc d7 b4) | (b4 d7 fc 6e))}
		$CreateServiceA = {((a2 86 92 5b) | (5b 92 86 a2))}
		$ExitWindowsEx = {((71 48 a2 80) | (80 a2 48 71))}
		$NtMapViewOfSection = {((79 d6 dd 92) | (92 dd d6 79))}
		$NtTerminateThread = {((a3 e3 27 31) | (31 27 e3 a3))}
		$Process32First = {((f5 82 73 4c) | (4c 73 82 f5))}
		$RegCreateKeyTransactedA = {((a5 76 30 0d) | (0d 30 76 a5))}
		$GetUserNameA = {((4b 66 fa 95) | (95 fa 66 4b))}
		$MapVirtualKeyA = {((77 ea 1c 1e) | (1e 1c ea 77))}
		$WNetCloseEnum = {((96 df 5f 35) | (35 5f df 96))}
		$InternetReadFileExA = {((f1 54 a3 19) | (19 a3 54 f1))}
		$GetComputerNameA = {((fd 98 9e 30) | (30 9e 98 fd))}
		$RegFlushKey = {((cd 6f 12 8c) | (8c 12 6f cd))}
		$VirtualAllocEx = {((8d c7 20 45) | (45 20 c7 8d))}
		$GetSystemDefaultLangId = {((07 69 30 f1) | (f1 30 69 07))}
		$SetFileTime = {((fe 2e 84 37) | (37 84 2e fe))}
		$SendNotifyMessageA = {((42 be 16 62) | (62 16 be 42))}
		$LookupAccountNameA = {((8a e1 6d c5) | (c5 6d e1 8a))}
		$NetShareEnum = {((a1 67 27 2d) | (2d 27 67 a1))}
		$IcmpSendEcho = {((07 c0 f6 85) | (85 f6 c0 07))}
		$DebugActiveProcessStop = {((94 5a 83 38) | (38 83 5a 94))}
		$NtCreateFile = {((bb dd 6a ff) | (ff 6a dd bb))}
		$DecryptFileA = {((88 6e 67 a0) | (a0 67 6e 88))}
		$GetRawInputData = {((0e 40 cb 2b) | (2b cb 40 0e))}
		$BringWindowToTop = {((54 66 aa b3) | (b3 aa 66 54))}
		$NetShareSetInfo = {((4f b8 99 a3) | (a3 99 b8 4f))}
		$GetLogicalDrives = {((2a b7 79 bf) | (bf 79 b7 2a))}
		$WriteFile = {((e0 bb ee 0f) | (0f ee bb e0))}
		$BitBlt = {((c8 20 8e fa) | (fa 8e 20 c8))}
		$SendMessageTimeoutA = {((e2 5b e6 e7) | (e7 e6 5b e2))}
		$GetCurrentProcess = {((ac f6 44 21) | (21 44 f6 ac))}
		$RegDeleteTreeA = {((c8 48 40 5d) | (5d 40 48 c8))}
		$CreateProcessWithTokenW = {((f5 b0 2b 5f) | (5f 2b b0 f5))}
		$FindWindowA = {((8d 19 bb 10) | (10 bb 19 8d))}
		$CopyFileA = {((d9 64 ce 43) | (43 ce 64 d9))}
		$FtpPutFileA = {((06 76 f3 86) | (86 f3 76 06))}
		$NtOpenProcess = {((17 42 a1 85) | (85 a1 42 17))}
		$Send = {((37 19 4a c4) | (c4 4a 19 37))}
		$EnumDeviceDrivers = {((b0 67 67 65) | (65 67 67 b0))}
		$Process32Next = {((07 e4 b2 ec) | (ec b2 e4 07))}
		$GetWindowDC = {((d9 c2 04 97) | (97 04 c2 d9))}
		$CryptDecrypt = {((3b 83 fc 2b) | (2b fc 83 3b))}
		$ReadFile = {((79 23 dd cf) | (cf dd 23 79))}
		$VirtualProtect = {((cc f7 dc e1) | (e1 dc f7 cc))}
		$OpenProcess = {((92 62 a1 76) | (76 a1 62 92))}
		$WaitForMultipleObjectsEx = {((e3 4f 30 e6) | (e6 30 4f e3))}
		$Inet_addr = {((6e ba a1 74) | (74 a1 ba 6e))}
		$WSAStartup = {((a1 69 db 38) | (38 db 69 a1))}
		$Bind = {((37 1a 48 a4) | (a4 48 1a 37))}
		$GetTempFileNameA = {((8f 40 ba 19) | (19 ba 40 8f))}
		$CreateMutexExA = {((9c 0f 54 2e) | (2e 54 0f 9c))}
		$DeviceIoControl = {((8b ab 5d ae) | (ae 5d ab 8b))}
		$CryptDestroyHash = {((4d 48 6d 2f) | (2f 6d 48 4d))}
		$CryptEncrypt = {((3b cc 00 2b) | (2b 00 cc 3b))}
		$NtSetContextThread = {((a3 1d 03 bd) | (bd 03 1d a3))}
		$CryptReleaseContext = {((b9 8e bf f4) | (f4 bf 8e b9))}
		$StretchBlt = {((dd db a2 5e) | (5e a2 db dd))}
		$NtWaitForSingleObject = {((d9 5b 86 8b) | (8b 86 5b d9))}
		$LoadLibraryExA = {((ef 33 91 38) | (38 91 33 ef))}
		$PeekMessageA = {((d1 65 fa 4c) | (4c fa 65 d1))}
		$WNetAddConnectionA = {((38 fd 28 62) | (62 28 fd 38))}
		$NtCreateThread = {((7b af f0 1b) | (1b f0 af 7b))}
		$ShellExecuteExA = {((7e 30 b6 0c) | (0c b6 30 7e))}
		$GetMessageA = {((da 65 f2 c2) | (c2 f2 65 da))}
		$GetCurrentHwProfileA = {((06 af be f8) | (f8 be af 06))}
		$PostThreadMessageA = {((f7 55 c4 21) | (21 c4 55 f7))}
		$RegOpenKeyExA = {((a3 b2 a1 fe) | (fe a1 b2 a3))}
		$CreateWaitableTimer = {((7e d7 7b 89) | (89 7b d7 7e))}
		$NtSetInformationProcess = {((d4 46 14 bd) | (bd 14 46 d4))}
		$InternetSetOptionA = {((6f 18 5d 72) | (72 5d 18 6f))}
		$GetClipboardData = {((f2 15 89 a7) | (a7 89 15 f2))}
		$HttpSendRequestExA = {((83 2a fa 79) | (79 fa 2a 83))}
		$CreateProcessA = {((79 72 c5 d4) | (d4 c5 72 79))}
		$CreateToolhelp32Snapshot = {((e8 8b e2 82) | (82 e2 8b e8))}
		$GetProcessHeap = {((59 be 2a 4c) | (4c 2a be 59))}
		$MapVirtualKeyExA = {((c3 08 9e 3b) | (3b 9e 08 c3))}
		$NtTerminateProcess = {((70 a2 e1 c6) | (c6 e1 a2 70))}
		$CallNextHookEx = {((00 15 d2 5d) | (5d d2 15 00))}
		$TerminateProcess = {((70 2e ba c6) | (c6 ba 2e 70))}
		$GetIpNetTable = {((8e 4e be 33) | (33 be 4e 8e))}
		$SetThreadToken = {((6e 43 00 2c) | (2c 00 43 6e))}
		$SetCurrentDirectory = {((9e 17 77 c7) | (c7 77 17 9e))}
		$GetFileTime = {((fe 2e 81 37) | (37 81 2e fe))}
		$CreateRemoteThread = {((33 37 3f e2) | (e2 3f 37 33))}
		$KeInsertQueueApc = {((fc 55 84 8f) | (8f 84 55 fc))}
		$SetWindowsHookExA = {((37 a7 c1 6d) | (6d c1 a7 37))}
		$EnumWindows = {((94 1c 3b 14) | (14 3b 1c 94))}
		$NtSetSystemEnvironmentValueEx = {((cd 53 34 41) | (41 34 53 cd))}
		$GetKeynameTextA = {((52 c7 84 0e) | (0e 84 c7 52))}
		$CryptCreateHash = {((06 ee fc 53) | (53 fc ee 06))}
		$CreateThread = {((74 6d 80 1b) | (1b 80 6d 74))}
		$GetCurrentThread = {((4a a7 dd aa) | (aa dd a7 4a))}
		$EnumResourceTypesExA = {((c8 c5 a4 0e) | (0e a4 c5 c8))}
		$OpenSCManagerA = {((36 b6 e5 4e) | (4e e5 b6 36))}
		$NtWriteVirtualMemory = {((02 54 f0 dd) | (dd f0 54 02))}
		$WSASocketA = {((c0 be 1a 29) | (29 1a be c0))}
		$SetWindowLongPtrA = {((b4 ac 19 be) | (be 19 ac b4))}
		$CryptAcquireContextA = {((fa ac 39 5e) | (5e 39 ac fa))}
		$Thread32Next = {((42 eb f5 04) | (04 f5 eb 42))}
		$RegisterRawInputDevices = {((2b f8 b0 9b) | (9b b0 f8 2b))}
		$Gethostbyname = {((dd 4e 3c 1f) | (1f 3c 4e dd))}
		$GetLogicalProcessorInformationEx = {((8d 87 69 96) | (96 69 87 8d))}
		$CreateWindowExA = {((ac b9 36 12) | (12 36 b9 ac))}
		$GetTickCount64 = {((58 1c e7 e0) | (e0 e7 1c 58))}
		$SendMessageCallbackA = {((a8 24 e7 a3) | (a3 e7 24 a8))}
		$WNetAddConnection2A = {((29 9c 7e d5) | (d5 7e 9c 29))}
		$ShellExecuteA = {((d7 2d 08 be) | (be 08 2d d7))}
		$CryptGenRandom = {((b8 86 fb 0c) | (0c fb 86 b8))}
		$RegConnectRegistryA = {((6f 6a e8 b0) | (b0 e8 6a 6f))}
		$CryptBinaryToString = {((59 f8 6e 86) | (86 6e f8 59))}
		$RtlMoveMemory = {((7f cb fe 1a) | (1a fe cb 7f))}
		$CopyFile2 = {((d9 64 ce 34) | (34 ce 64 d9))}
		$TimeGetTime = {((e6 f7 fc b6) | (b6 fc f7 e6))}
		$Thread32First = {((01 9f f6 ee) | (ee f6 9f 01))}
		$PostMessageA = {((da 6c fc cc) | (cc fc 6c da))}
		$WSACleanup = {((e1 28 19 18) | (18 19 28 e1))}
		$NtShutdownSystem = {((76 eb 7e a2) | (a2 7e eb 76))}
		$GetModuleFileNameA = {((ea a0 34 fb) | (fb 34 a0 ea))}
		$Socket = {((25 32 cc db) | (db cc 32 25))}
		$NtCreateUserProcess = {((9d ea 66 b3) | (b3 66 ea 9d))}
		$GetCurrentProcessId = {((b5 88 6b a1) | (a1 6b 88 b5))}
		$InternetCloseHandle = {((48 58 5c bb) | (bb 5c 58 48))}
		$OpenFileMappingA = {((01 36 56 0c) | (0c 56 36 01))}
		$NtQueryDirectoryFile = {((25 57 95 08) | (08 95 57 25))}
		$GetAdaptersInfo = {((fe 20 e0 a2) | (a2 e0 20 fe))}
		$MapViewOfFile = {((26 8f 42 02) | (02 42 8f 26))}
		$TerminateThread = {((bb 95 27 30) | (30 27 95 bb))}
		$ControlServiceExA = {((99 eb 62 92) | (92 62 eb 99))}
		$CreateProcessInternal = {((77 22 d2 6b) | (6b d2 22 77))}
		$CreateMutexA = {((4f b5 80 39) | (39 80 b5 4f))}
		$WSAIoctl = {((cc 22 1a fe) | (fe 1a 22 cc))}
		$RegOpenKeyTransactedA = {((83 c3 d2 05) | (05 d2 c3 83))}
		$Connect = {((15 12 5a 3b) | (3b 5a 12 15))}
		$RegQueryInfoKeyA = {((f2 17 55 1d) | (1d 55 17 f2))}
		$RegSetKeySecurity = {((57 0b 0f d2) | (d2 0f 0b 57))}
		$NtClose = {((6d 3d 05 e9) | (e9 05 3d 6d))}
		$Sleep = {((62 99 4d f5) | (f5 4d 99 62))}
		$NtProtectVirtualMemory = {((7a 9e b7 08) | (08 b7 9e 7a))}
		$NtReadVirtualMemory = {((70 74 f7 07) | (07 f7 74 70))}
		$Gethostname = {((ee 64 9c bc) | (bc 9c 64 ee))}
		$CopyFileExA = {((6f 91 f6 9a) | (9a f6 91 6f))}
		$Wow64SetThreadContext = {((fa 22 25 02) | (02 25 22 fa))}
		$EnumProcessModulesEx = {((02 c0 af 2e) | (2e af c0 02))}
		$GetSystemDirectoryA = {((f6 90 0a cf) | (cf 0a 90 f6))}
		$NtCreateProcess = {((e5 8e c8 2a) | (2a c8 8e e5))}
		$SetThreadContext = {((2c 08 99 e5) | (e5 99 08 2c))}
		$DnsQueryEx = {((e4 69 93 a4) | (a4 93 69 e4))}
		$LoadResource = {((09 66 bf 7a) | (7a bf 66 09))}
		$NtAllocateVirtualMemory = {((2e 0a 10 7c) | (7c 10 0a 2e))}
		$ConnectNamedPipe = {((f6 61 89 b6) | (b6 89 61 f6))}
		$RegDeleteKeyValueA = {((05 aa 21 af) | (af 21 aa 05))}
		$CreatePipe = {((fd dd 4f 35) | (35 4f dd fd))}
		$NtDelayExecution = {((f2 42 9e 03) | (03 9e 42 f2))}
		$RtlGetVersion = {((45 07 42 cc) | (cc 42 07 45))}
		$NtOpenThread = {((e3 62 a4 7e) | (7e a4 62 e3))}
		$RegReplaceKeyA = {((e6 37 f3 0c) | (0c f3 37 e6))}
		$RtlCreateHeap = {((7b 7c 69 4f) | (4f 69 7c 7b))}
		$CheckRemoteDebuggerPresent = {((b9 e5 15 b4) | (b4 15 e5 b9))}
		$GetProcessIdOfThread = {((aa e2 d7 ed) | (ed d7 e2 aa))}
		$SetForegroundWindow = {((72 51 ff f8) | (f8 ff 51 72))}
		$SetWinEventHook = {((a7 87 a1 f5) | (f5 a1 87 a7))}
		$RegisterHotKey = {((7f 60 c2 17) | (17 c2 60 7f))}
		$NtQueryInformationProcess = {((22 cf 82 c7) | (c7 82 cf 22))}
		$CreateRemoteThreadEx = {((f2 78 8d 45) | (45 8d 78 f2))}
		$OpenClipboard = {((a4 c1 0c 70) | (70 0c c1 a4))}
		$RegEnumValueA = {((58 91 9c 7e) | (7e 9c 91 58))}
		$URLDownloadToCacheFile = {((38 a3 3e e4) | (e4 3e a3 38))}
		$LocalAlloc = {((ba 22 92 ad) | (ad 92 22 ba))}
		$ShowWindow = {((32 7c 6b 1c) | (1c 6b 7c 32))}
		$VirtualQueryEx = {((1e 14 e0 a5) | (a5 e0 14 1e))}
		$NtQueueApcThread = {((37 c0 02 a8) | (a8 02 c0 37))}
		$NtMakeTemporaryObject = {((d5 0f 88 50) | (50 88 0f d5))}
		$VirtualAllocExNuma = {((8f 79 bc 25) | (25 bc 79 8f))}
		$RegOpenKeyA = {((86 f5 9e c6) | (c6 9e f5 86))}
		$EnumDesktopWindows = {((de df 88 dd) | (dd 88 df de))}
		$WaitForSingleObject = {((ca d6 a6 8b) | (8b a6 d6 ca))}
		$FindResourceExA = {((69 b8 ff 6a) | (6a ff b8 69))}
		$CryptStringToBinary = {((1a 1c f8 18) | (18 f8 1c 1a))}
		$RegEnumKeyA = {((77 75 96 b2) | (b2 96 75 77))}
		$Select = {((84 31 4d fa) | (fa 4d 31 84))}
		$WNetEnumResourceA = {((38 f3 da 35) | (35 da f3 38))}
		$EnumProcesses = {((9a 3d 29 0b) | (0b 29 3d 9a))}
		$Listen = {((c4 fd 0e d4) | (d4 0e fd c4))}
		$RegCreateKeyA = {((a7 7c 68 3e) | (3e 68 7c a7))}
		$IsDebuggerPresent = {((7c 4a 52 9e) | (9e 52 4a 7c))}
		$FindNextUrlCacheEntryA = {((07 45 17 80) | (80 17 45 07))}
		$StartServiceA = {((8f 93 7a 5d) | (5d 7a 93 8f))}
		$GetThreadContext = {((14 08 99 e5) | (e5 99 08 14))}
		$VirtualAlloc = {((7f 35 ad 1c) | (1c ad 35 7f))}
		$Module32First = {((ec 37 f3 70) | (70 f3 37 ec))}
		$FindFirstUrlCacheEntryA = {((94 12 76 11) | (11 76 12 94))}
		$SleepEx = {((75 fd 59 1e) | (1e 59 fd 75))}
		$MoveFileA = {((e2 c4 e6 43) | (43 e6 c4 e2))}
		$NtSetValueKey = {((7f 06 e6 9b) | (9b e6 06 7f))}
		$SetWindowLongA = {((eb dc 78 bc) | (bc 78 dc eb))}
		$MapViewOfFileEx = {((f3 00 8a 1b) | (1b 8a 00 f3))}
		$NtDuplicateObject = {((24 96 26 01) | (01 26 96 24))}
		$GetKeyboardState = {((0f 1e d7 8e) | (8e d7 1e 0f))}
		$GetSystemTime = {((27 5d b8 df) | (df b8 5d 27))}
		$FindWindowExA = {((aa c5 23 87) | (87 23 c5 aa))}
		$RegQueryMultipleValuesA = {((74 37 10 fc) | (fc 10 37 74))}
		$DrawTextExA = {((20 73 b0 b7) | (b7 b0 73 20))}
		$RegEnumKeyExA = {((a1 ad 9e 1e) | (1e 9e ad a1))}
		$QueueUserAPC = {((10 dc 40 9e) | (9e 40 dc 10))}
		$RegSaveKeyA = {((f7 7d 62 cd) | (cd 62 7d f7))}
		$CreateFileMappingA = {((2d 18 ef 50) | (50 ef 18 2d))}
		$CryptDestroyKey = {((92 da 4e a0) | (a0 4e da 92))}
		$RegDeleteKeyExA = {((7a 14 26 e0) | (e0 26 14 7a))}
		$EnumResourceTypesA = {((8f 36 33 12) | (12 33 36 8f))}
		$RegSetKeyValueA = {((f6 fc 75 23) | (23 75 fc f6))}
		$timeSetEvent = {((6f f1 7e 2d) | (2d 7e f1 6f))}
		$RegSaveKeyExA = {((94 b4 7e 20) | (20 7e b4 94))}
		$CountClipboardFormats = {((eb 1d b3 7c) | (7c b3 1d eb))}
		$HttpAddRequestHeaders = {((bc 8d 54 dd) | (dd 54 8d bc))}
		$NtQueueApcThreadEx2 = {((34 11 95 39) | (39 95 11 34))}
		$RegCopyTreeA = {((f9 96 a8 ae) | (ae a8 96 f9))}
		$ImpersonateLoggedOnUser = {((8f b3 d6 37) | (37 d6 b3 8f))}
		$GetDriveTypeA = {((8c 58 05 45) | (45 05 58 8c))}
		$GetVersionExA = {((38 f6 37 f9) | (f9 37 f6 38))}
		$InternetReadFile = {((c5 aa 1b 16) | (16 1b aa c5))}
		$RegOpenCurrentUser = {((7d 01 9b 08) | (08 9b 01 7d))}
		$GetThreadLocale = {((14 f6 20 b5) | (b5 20 f6 14))}
		$NtUnmapViewOfSection = {((c3 90 e1 2f) | (2f e1 90 c3))}
		$FindNextFileA = {((08 cf 09 bd) | (bd 09 cf 08))}
		$GetLogicalProcessorInformation = {((a4 79 ac 1d) | (1d ac 79 a4))}
		$FlushEfsCache = {((54 4c 02 61) | (61 02 4c 54))}
		$Closesocket = {((95 6a 72 81) | (81 72 6a 95))}
		$NetShareGetInfo = {((4f b8 69 a3) | (a3 69 b8 4f))}
		$GetModuleHandleA = {((f4 b2 68 34) | (34 68 b2 f4))}
		$VirtualAlloc2FromApp = {((48 20 9c 28) | (28 9c 20 48))}
		$MoveFileExA = {((75 91 f8 f2) | (f2 f8 91 75))}
		$NtWaitForMultipleObjects = {((92 57 03 3e) | (3e 03 57 92))}
		$DeleteFileA = {((01 f7 6f 30) | (30 6f f7 01))}
		$StartServiceCtrlDispatcherA = {((a5 60 ec b3) | (b3 ec 60 a5))}
		$HttpOpenRequestA = {((72 dc 9f 67) | (67 9f dc 72))}
		$GetThreadInformation = {((50 82 8e 01) | (01 8e 82 50))}
		$NtDeleteKey = {((b9 f6 91 6a) | (6a 91 f6 b9))}
		$InternetWriteFile = {((84 62 31 2e) | (2e 31 62 84))}
		$LoadLibraryA = {((43 de cc ca) | (ca cc de 43))}
		$RegQueryValueExA = {((51 bf 24 78) | (78 24 bf 51))}
		$NtCreateProcessEx = {((d4 8a b9 db) | (db b9 8a d4))}
		$GetForegroundWindow = {((72 51 ff f5) | (f5 ff 51 72))}
		$NtQuerySystemEnvironmentValueEx = {((f3 0b 59 7b) | (7b 59 0b f3))}
		$SizeOfResource = {((d1 f0 54 ff) | (ff 54 f0 d1))}
		$RegGetValueA = {((cc 82 b7 db) | (db b7 82 cc))}
		$LdrLoadDll = {((ad b0 3d d6) | (d6 3d b0 ad))}
		$NtResumeThread = {((6f b6 ec cf) | (cf ec b6 6f))}
		$MapViewOfFile3 = {((01 13 47 d4) | (d4 47 13 01))}
		$NtQueryTimer = {((ab 8d b3 6b) | (6b b3 8d ab))}
		$RtlCopyMemory = {((7f c7 4e 0e) | (0e 4e c7 7f))}
		$InternetConnectA = {((6a 10 c6 b5) | (b5 c6 10 6a))}
		$SetClipboardData = {((0a 15 89 a8) | (a8 89 15 0a))}
		$GetKeyState = {((e2 14 75 40) | (40 75 14 e2))}
		$WriteProcessMemory = {((08 2c 8c 25) | (25 8c 2c 08))}
		$RtlSetProcessIsCritical = {((c4 11 4a 5f) | (5f 4a 11 c4))}
		$NetShareAdd = {((c9 4c 81 31) | (31 81 4c c9))}
		$NtResumeProcess = {((3f 88 cb a9) | (a9 cb 88 3f))}
		$GetProcessHeaps = {((26 2c df 88) | (88 df 2c 26))}
		$RegDeleteKeyTransactedA = {((65 9a 33 8a) | (8a 33 9a 65))}
		$ReadProcessMemory = {((00 0c 58 59) | (59 58 0c 00))}
		$GetNativeSystemInfo = {((a2 76 c7 e1) | (e1 c7 76 a2))}
		$ioctlsocket = {((89 6c 18 03) | (03 18 6c 89))}
		$CreateProcessAsUserA = {((57 c8 a0 8c) | (8c a0 c8 57))}
		$PeekNamedPipe = {((6e 79 98 7a) | (7a 98 79 6e))}
		$SuspendThread = {((bd a2 fc 55) | (55 fc a2 bd))}
		$CallWindowProcA = {((2a 4d 2a 28) | (28 2a 4d 2a))}
		$OpenServiceA = {((e4 5c fe 18) | (18 fe 5c e4))}
		$SetTimer = {((76 3c e2 3d) | (3d e2 3c 76))}
		$MapViewOfFile2 = {((01 13 47 d3) | (d3 47 13 01))}
		$RegRestoreKeyA = {((e9 b0 2b 1c) | (1c 2b b0 e9))}
		$InternetOpenUrlA = {((65 cc 88 cd) | (cd 88 cc 65))}
		$GetTempPathA = {((6b d8 da 79) | (79 da d8 6b))}
		$NtAdjustPrivilegesToken = {((4e f5 5c ed) | (ed 5c f5 4e))}
		$GetTickCount = {((9e b0 f4 73) | (73 f4 b0 9e))}
		$RegSetValueExA = {((e9 f7 f6 61) | (61 f6 f7 e9))}
		$NtCreateSection = {((23 27 d6 45) | (45 d6 27 23))}
		$SetPropA = {((3b bd 63 2c) | (2c 63 bd 3b))}
		$GetModuleFileNameExA = {((49 3f fa e9) | (e9 fa 3f 49))}
		$PathFileExistsA = {((40 d5 be 3f) | (3f be d5 40))}
		$SetFocus = {((9e 3a 62 fd) | (fd 62 3a 9e))}
		$GetDCEx = {((65 b9 e4 ff) | (ff e4 b9 65))}
		$WNetOpenEnumA = {((9e b8 fc 2f) | (2f fc b8 9e))}
		$FindFirstFileA = {((c5 f2 23 57) | (57 23 f2 c5))}
		$AttachThreadInput = {((2e 65 b1 e1) | (e1 b1 65 2e))}
		$AdjustTokenPrivileges = {((83 b6 85 64) | (64 85 b6 83))}
		$EnumProcessModules = {((ba d7 81 02) | (02 81 d7 ba))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6b569e43-214b-4d7e-9301-27c7c8dcc1ee
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
