api_hashes_rol3XorEax

YARA detection rule by filescanio
Rule api_hashes_rol3XorEax (No description metadata provided).
import "math"
import "pe"
rule api_hashes_rol3XorEax : hardened
{
	strings:
		$ControlService = {((9f 68 41 5d) | (5d 41 68 9f))}
		$HttpSendRequestA = {((f1 95 da a9) | (a9 da 95 f1))}
		$SetThreadPriority = {((eb 6c ff c7) | (c7 ff 6c eb))}
		$Recv = {((87 13 ab 3b) | (3b ab 13 87))}
		$QueryPerformanceFrequency = {((fd ed 9c ce) | (ce 9c ed fd))}
		$RegDeleteValueA = {((4a 27 af fd) | (fd af 27 4a))}
		$GetWindowsDirectoryA = {((cf 9d c0 bf) | (bf c0 9d cf))}
		$CryptSetKeyParam = {((77 95 ab 6e) | (6e ab 95 77))}
		$RegCreateKeyExA = {((50 a3 26 43) | (43 26 a3 50))}
		$Module32Next = {((b9 c0 f4 7f) | (7f f4 c0 b9))}
		$RegOpenUserClassesRoot = {((07 01 95 cd) | (cd 95 01 07))}
		$NtReadVirtualMemoryEx = {((c4 2c de 32) | (32 de 2c c4))}
		$InternetOpenA = {((82 99 96 74) | (74 96 99 82))}
		$URLOpenBlockingStream = {((e3 a1 33 a5) | (a5 33 a1 e3))}
		$NtSetInformationThread = {((67 5b 30 24) | (24 30 5b 67))}
		$CreateFileA = {((44 48 52 a2) | (a2 52 48 44))}
		$UnhookWindowsHookEx = {((53 d1 52 00) | (00 52 d1 53))}
		$GetCurrentThreadId = {((c2 b6 9f 9e) | (9e 9f b6 c2))}
		$Accept = {((32 b7 37 46) | (46 37 b7 32))}
		$HeapReAlloc = {((ee a9 4a 1b) | (1b 4a a9 ee))}
		$WinExec = {((13 04 05 88) | (88 05 04 13))}
		$NtQueueApcThreadEx = {((ca c3 28 60) | (60 28 c3 ca))}
		$VirtualAllocFromApp = {((7a af 86 ea) | (ea 86 af 7a))}
		$RegLoadKeyA = {((6a b4 6b b2) | (b2 6b b4 6a))}
		$OutputDebugStringA = {((d1 fd ea b2) | (b2 ea fd d1))}
		$GetFileAttributesA = {((b0 27 83 f5) | (f5 83 27 b0))}
		$SetWaitableTimer = {((ad 69 1b ed) | (ed 1b 69 ad))}
		$SendMessageA = {((25 49 79 15) | (15 79 49 25))}
		$RegUnLoadKeyA = {((2b 9a b4 0d) | (0d b4 9a 2b))}
		$SetEnvironmentVariableA = {((1f ea c5 e5) | (e5 c5 ea 1f))}
		$VirtualAlloc2 = {((9c 65 07 65) | (65 07 65 9c))}
		$CryptProtectData = {((76 05 ec 8c) | (8c ec 05 76))}
		$GetDesktopWindow = {((d4 32 a4 70) | (70 a4 32 d4))}
		$RegGetKeySecurity = {((a2 74 a3 31) | (31 a3 74 a2))}
		$GetDC = {((78 60 19 43) | (43 19 60 78))}
		$LookupPrivilegeValueA = {((bf c1 be 1c) | (1c be c1 bf))}
		$CryptGetHashParam = {((bb 19 d9 62) | (62 d9 19 bb))}
		$HeapAlloc = {((0b 53 56 18) | (18 56 53 0b))}
		$RegCloseKey = {((44 fd 32 e6) | (e6 32 fd 44))}
		$CryptHashData = {((50 98 c0 eb) | (eb c0 98 50))}
		$GlobalAlloc = {((52 6b 2c c2) | (c2 2c 6b 52))}
		$RegOverridePredefKey = {((88 50 88 26) | (26 88 50 88))}
		$EnumSystemLocalesA = {((f9 8b 0d 63) | (63 0d 8b f9))}
		$GetProcessId = {((c3 4b 44 76) | (76 44 4b c3))}
		$RegLoadMUIStringA = {((19 bd 3f 2c) | (2c 3f bd 19))}
		$SearchPathA = {((30 93 2e 53) | (53 2e 93 30))}
		$FindClose = {((84 da 6c 07) | (07 6c da 84))}
		$NtDeleteValueKey = {((fa ee b8 73) | (73 b8 ee fa))}
		$URLDownloadToFile = {((fb 2f e1 f2) | (f2 e1 2f fb))}
		$Toolhelp32ReadProcessMemory = {((78 6e 49 db) | (db 49 6e 78))}
		$GetProcAddress = {((9c 31 ee 08) | (08 ee 31 9c))}
		$OpenProcessToken = {((38 c9 5c ac) | (ac 5c c9 38))}
		$HeapCreate = {((ef 27 1a a9) | (a9 1a 27 ef))}
		$UuidFromStringA = {((72 22 74 1b) | (1b 74 22 72))}
		$VirtualProtectEx = {((24 55 40 79) | (79 40 55 24))}
		$GetSystemTimeAsFileTime = {((cf c0 2f 55) | (55 2f c0 cf))}
		$GetModuleBaseNameA = {((76 c3 cd 72) | (72 cd c3 76))}
		$lstrcatA = {((b5 9e cf 86) | (86 cf 9e b5))}
		$SetFileAttributesA = {((db 27 87 60) | (60 87 27 db))}
		$FindResourceA = {((a8 08 2a 22) | (22 2a 08 a8))}
		$WaitForMultipleObjects = {((2f 7a 08 bb) | (bb 08 7a 2f))}
		$QueryPerformanceCounter = {((1a 94 a7 8b) | (8b a7 94 1a))}
		$NtCreateThreadEx = {((c6 b1 03 d8) | (d8 03 b1 c6))}
		$NtContinue = {((53 f3 7c 33) | (33 7c f3 53))}
		$IsWoW64Process = {((5c b9 de 33) | (33 de b9 5c))}
		$DnsQuery_A = {((cc 8c df 91) | (91 df 8c cc))}
		$VirtualProtectFromApp = {((dc 34 b3 5b) | (5b b3 34 dc))}
		$GetAsyncKeyState = {((80 34 d3 6c) | (6c d3 34 80))}
		$EncryptFileA = {((ae 02 90 91) | (91 90 02 ae))}
		$DuplicateToken = {((b2 f2 78 4a) | (4a 78 f2 b2))}
		$CryptDeriveKey = {((38 07 cd 14) | (14 cd 07 38))}
		$LockResource = {((7f 3f b5 bd) | (bd b5 3f 7f))}
		$ResumeThread = {((c5 07 c4 3d) | (3d c4 07 c5))}
		$WaitForSingleObjectEx = {((1b fb 3a 1b) | (1b 3a fb 1b))}
		$NtSuspendProcess = {((bd 7e 31 27) | (27 31 7e bd))}
		$NetShareCheck = {((26 d8 67 53) | (53 67 d8 26))}
		$OpenThread = {((0b 59 51 cb) | (cb 51 59 0b))}
		$URLOpenStream = {((28 79 a9 a2) | (a2 a9 79 28))}
		$UnmapViewOfFile = {((fd b7 e8 0c) | (0c e8 b7 fd))}
		$CreateFile2 = {((44 48 51 3a) | (3a 51 48 44))}
		$DeleteService = {((16 9b bc 40) | (40 bc 9b 16))}
		$GetThreadId = {((57 79 af 87) | (87 af 79 57))}
		$RegDeleteKeyA = {((32 90 33 92) | (92 33 90 32))}
		$CreateTimerQueueTimer = {((41 4f 9f a5) | (a5 9f 4f 41))}
		$SetProcessDEPPolicy = {((7c d3 3c 31) | (31 3c d3 7c))}
		$CreateServiceA = {((c7 f7 7f e4) | (e4 7f f7 c7))}
		$ExitWindowsEx = {((d2 a1 3b 6a) | (6a 3b a1 d2))}
		$NtMapViewOfSection = {((c7 3f 7f 09) | (09 7f 3f c7))}
		$NtTerminateThread = {((65 fa a8 4d) | (4d a8 fa 65))}
		$Process32First = {((62 9f 43 c4) | (c4 43 9f 62))}
		$RegCreateKeyTransactedA = {((b0 90 47 75) | (75 47 90 b0))}
		$GetUserNameA = {((fb 3e c7 e1) | (e1 c7 3e fb))}
		$MapVirtualKeyA = {((06 e9 16 36) | (36 16 e9 06))}
		$WNetCloseEnum = {((2b ee 79 06) | (06 79 ee 2b))}
		$InternetReadFileExA = {((23 51 33 7b) | (7b 33 51 23))}
		$GetComputerNameA = {((03 f2 f5 e9) | (e9 f5 f2 03))}
		$RegFlushKey = {((19 df ec 45) | (45 ec df 19))}
		$VirtualAllocEx = {((98 32 0d 30) | (30 0d 32 98))}
		$GetSystemDefaultLangId = {((1b e9 da fa) | (fa da e9 1b))}
		$SetFileTime = {((cb 4f 61 71) | (71 61 4f cb))}
		$SendNotifyMessageA = {((d2 b7 b2 3b) | (3b b2 b7 d2))}
		$LookupAccountNameA = {((2a 69 45 39) | (39 45 69 2a))}
		$NetShareEnum = {((1d 03 07 f1) | (f1 07 03 1d))}
		$IcmpSendEcho = {((82 fc 84 41) | (41 84 fc 82))}
		$DebugActiveProcessStop = {((f1 b5 1b a9) | (a9 1b b5 f1))}
		$NtCreateFile = {((03 ca 04 6f) | (6f 04 ca 03))}
		$DecryptFileA = {((ae 01 a8 d7) | (d7 a8 01 ae))}
		$GetRawInputData = {((95 a4 b9 c5) | (c5 b9 a4 95))}
		$BringWindowToTop = {((7e 18 b3 7b) | (7b b3 18 7e))}
		$NetShareSetInfo = {((58 cb 55 35) | (35 55 cb 58))}
		$GetLogicalDrives = {((a4 c5 c6 67) | (67 c6 c5 a4))}
		$WriteFile = {((77 ee f0 43) | (43 f0 ee 77))}
		$BitBlt = {((2b 40 2e 42) | (42 2e 40 2b))}
		$SendMessageTimeoutA = {((95 77 eb f7) | (f7 eb 77 95))}
		$GetCurrentProcess = {((2e a9 cd 77) | (77 cd a9 2e))}
		$RegDeleteTreeA = {((fd bd 77 9e) | (9e 77 bd fd))}
		$CreateProcessWithTokenW = {((7c 12 f5 f9) | (f9 f5 12 7c))}
		$FindWindowA = {((8e d0 83 0a) | (0a 83 d0 8e))}
		$CopyFileA = {((ac ee a3 5f) | (5f a3 ee ac))}
		$FtpPutFileA = {((e1 b0 b3 2f) | (2f b3 b0 e1))}
		$NtOpenProcess = {((a9 31 90 22) | (22 90 31 a9))}
		$Send = {((8f 51 d0 eb) | (eb d0 51 8f))}
		$EnumDeviceDrivers = {((94 97 84 88) | (88 84 97 94))}
		$Process32Next = {((47 53 51 b4) | (b4 51 53 47))}
		$GetWindowDC = {((4f 39 42 9c) | (9c 42 39 4f))}
		$CryptDecrypt = {((8b b8 7a 42) | (42 7a b8 8b))}
		$ReadFile = {((c7 ab 0b 6f) | (6f 0b ab c7))}
		$VirtualProtect = {((a9 9c a9 eb) | (eb a9 9c a9))}
		$OpenProcess = {((86 5a f8 f4) | (f4 f8 5a 86))}
		$WaitForMultipleObjectsEx = {((a0 04 d4 59) | (59 d4 04 a0))}
		$Inet_addr = {((ec 34 cd 1f) | (1f cd 34 ec))}
		$WSAStartup = {((86 5d 94 05) | (05 94 5d 86))}
		$Bind = {((03 51 d8 eb) | (eb d8 51 03))}
		$GetTempFileNameA = {((fb f9 9a e7) | (e7 9a f9 fb))}
		$CreateMutexExA = {((52 8c ce 69) | (69 ce 8c 52))}
		$DeviceIoControl = {((db a7 5c 24) | (24 5c a7 db))}
		$CryptDestroyHash = {((77 29 75 1b) | (1b 75 29 77))}
		$CryptEncrypt = {((ba 34 7a 48) | (48 7a 34 ba))}
		$NtSetContextThread = {((aa 6b 5b 21) | (21 5b 6b aa))}
		$CryptReleaseContext = {((5c 0e 04 65) | (65 04 0e 5c))}
		$StretchBlt = {((60 b4 1f d3) | (d3 1f b4 60))}
		$NtWaitForSingleObject = {((17 73 a1 59) | (59 a1 73 17))}
		$LoadLibraryExA = {((f7 76 2a f5) | (f5 2a 76 f7))}
		$PeekMessageA = {((9d 3f c9 92) | (92 c9 3f 9d))}
		$WNetAddConnectionA = {((9f 6c c4 44) | (44 c4 6c 9f))}
		$NtCreateThread = {((56 57 28 e5) | (e5 28 57 56))}
		$ShellExecuteExA = {((ee fe b7 0a) | (0a b7 fe ee))}
		$GetMessageA = {((66 2f 0f b9) | (b9 0f 2f 66))}
		$GetCurrentHwProfileA = {((eb 27 eb aa) | (aa eb 27 eb))}
		$PostThreadMessageA = {((76 4a 06 14) | (14 06 4a 76))}
		$RegOpenKeyExA = {((9d df 82 53) | (53 82 df 9d))}
		$CreateWaitableTimer = {((e6 3d 8c 96) | (96 8c 3d e6))}
		$NtSetInformationProcess = {((e6 49 f8 a9) | (a9 f8 49 e6))}
		$InternetSetOptionA = {((d4 50 20 37) | (37 20 50 d4))}
		$GetClipboardData = {((27 b9 dc 72) | (72 dc b9 27))}
		$HttpSendRequestExA = {((1a 4c 3e 64) | (64 3e 4c 1a))}
		$CreateProcessA = {((ac 25 aa 3b) | (3b aa 25 ac))}
		$CreateToolhelp32Snapshot = {((9f 89 58 49) | (49 58 89 9f))}
		$GetProcessHeap = {((43 e1 5c 77) | (77 5c e1 43))}
		$MapVirtualKeyExA = {((2e 3f 19 ac) | (ac 19 3f 2e))}
		$NtTerminateProcess = {((f3 3a 34 c1) | (c1 34 3a f3))}
		$CallNextHookEx = {((31 93 e5 80) | (80 e5 93 31))}
		$TerminateProcess = {((67 a3 4b 7a) | (7a 4b a3 67))}
		$GetIpNetTable = {((c8 bc 55 d9) | (d9 55 bc c8))}
		$SetThreadToken = {((e1 14 2a 8a) | (8a 2a 14 e1))}
		$SetCurrentDirectory = {((8d c6 cc 55) | (55 cc c6 8d))}
		$GetFileTime = {((cb 62 86 a9) | (a9 86 62 cb))}
		$CreateRemoteThread = {((db a7 f9 e2) | (e2 f9 a7 db))}
		$KeInsertQueueApc = {((67 1c 35 53) | (53 35 1c 67))}
		$SetWindowsHookExA = {((f5 a0 48 ce) | (ce 48 a0 f5))}
		$EnumWindows = {((bf d3 f7 79) | (79 f7 d3 bf))}
		$NtSetSystemEnvironmentValueEx = {((e3 80 2f cf) | (cf 2f 80 e3))}
		$GetKeynameTextA = {((7e d1 db 23) | (23 db d1 7e))}
		$CryptCreateHash = {((0c c5 1f d4) | (d4 1f c5 0c))}
		$CreateThread = {((dd 8c f6 15) | (15 f6 8c dd))}
		$GetCurrentThread = {((be 47 37 1b) | (1b 37 47 be))}
		$EnumResourceTypesExA = {((92 4c fe 5f) | (5f fe 4c 92))}
		$OpenSCManagerA = {((83 08 fd 3f) | (3f fd 08 83))}
		$NtWriteVirtualMemory = {((39 a5 e2 93) | (93 e2 a5 39))}
		$WSASocketA = {((71 57 6b 1c) | (1c 6b 57 71))}
		$SetWindowLongPtrA = {((e5 71 b5 25) | (25 b5 71 e5))}
		$CryptAcquireContextA = {((bd d8 7e cb) | (cb 7e d8 bd))}
		$Thread32Next = {((90 2a 4f b1) | (b1 4f 2a 90))}
		$RegisterRawInputDevices = {((08 2b 3a 06) | (06 3a 2b 08))}
		$Gethostbyname = {((23 c8 8b 0b) | (0b 8b c8 23))}
		$GetLogicalProcessorInformationEx = {((e8 b7 c2 58) | (58 c2 b7 e8))}
		$CreateWindowExA = {((fa 1a 00 83) | (83 00 1a fa))}
		$GetTickCount64 = {((0d 8d c4 88) | (88 c4 8d 0d))}
		$SendMessageCallbackA = {((5f d2 27 61) | (61 27 d2 5f))}
		$WNetAddConnection2A = {((80 17 ac f0) | (f0 ac 17 80))}
		$ShellExecuteA = {((9f 76 10 8b) | (8b 10 76 9f))}
		$CryptGenRandom = {((4a 35 34 7f) | (7f 34 35 4a))}
		$RegConnectRegistryA = {((3a bb 2c 7d) | (7d 2c bb 3a))}
		$CryptBinaryToString = {((d0 46 ae 0c) | (0c ae 46 d0))}
		$RtlMoveMemory = {((cc 93 70 dd) | (dd 70 93 cc))}
		$CopyFile2 = {((ac ee a0 c7) | (c7 a0 ee ac))}
		$TimeGetTime = {((0a 0d a1 9e) | (9e a1 0d 0a))}
		$Thread32First = {((d9 5f b3 ee) | (ee b3 5f d9))}
		$PostMessageA = {((e5 58 16 e0) | (e0 16 58 e5))}
		$WSACleanup = {((df 8e 13 cd) | (cd 13 8e df))}
		$NtShutdownSystem = {((49 49 52 e4) | (e4 52 49 49))}
		$GetModuleFileNameA = {((a1 23 3b bc) | (bc 3b 23 a1))}
		$Socket = {((03 4a 06 64) | (64 06 4a 03))}
		$NtCreateUserProcess = {((4a 3d 70 53) | (53 70 3d 4a))}
		$GetCurrentProcessId = {((6d 35 c4 ba) | (ba c4 35 6d))}
		$InternetCloseHandle = {((ed 24 d8 91) | (91 d8 24 ed))}
		$OpenFileMappingA = {((e0 20 92 29) | (29 92 20 e0))}
		$NtQueryDirectoryFile = {((f2 09 73 19) | (19 73 09 f2))}
		$GetAdaptersInfo = {((86 50 30 4e) | (4e 30 50 86))}
		$MapViewOfFile = {((b8 8d f3 8f) | (8f f3 8d b8))}
		$TerminateThread = {((57 66 4f 5e) | (5e 4f 66 57))}
		$ControlServiceExA = {((e5 32 ae 38) | (38 ae 32 e5))}
		$CreateProcessInternal = {((a2 07 78 84) | (84 78 07 a2))}
		$CreateMutexA = {((0b 3a d9 69) | (69 d9 3a 0b))}
		$WSAIoctl = {((f6 6f 69 c2) | (c2 69 6f f6))}
		$RegOpenKeyTransactedA = {((a0 53 1b d1) | (d1 1b 53 a0))}
		$Connect = {((70 e7 fe 79) | (79 fe e7 70))}
		$RegQueryInfoKeyA = {((d0 77 39 86) | (86 39 77 d0))}
		$RegSetKeySecurity = {((bd ba d3 31) | (31 d3 ba bd))}
		$NtClose = {((70 bb 4f eb) | (eb 4f bb 70))}
		$Sleep = {((1b f5 ea a0) | (a0 ea f5 1b))}
		$NtProtectVirtualMemory = {((93 85 6e 8b) | (8b 6e 85 93))}
		$NtReadVirtualMemory = {((c6 2d e2 92) | (92 e2 2d c6))}
		$Gethostname = {((7f f3 86 0d) | (0d 86 f3 7f))}
		$CopyFileExA = {((08 d2 43 f4) | (f4 43 d2 08))}
		$Wow64SetThreadContext = {((6b 9f 2f 49) | (49 2f 9f 6b))}
		$EnumProcessModulesEx = {((11 89 ee 26) | (26 ee 89 11))}
		$GetSystemDirectoryA = {((88 24 27 ab) | (ab 27 24 88))}
		$NtCreateProcess = {((6e 2e 32 82) | (82 32 2e 6e))}
		$SetThreadContext = {((af a9 b8 c4) | (c4 b8 a9 af))}
		$DnsQueryEx = {((cc 8c 08 d9) | (d9 08 8c cc))}
		$LoadResource = {((87 3f 35 d4) | (d4 35 3f 87))}
		$NtAllocateVirtualMemory = {((52 ec 37 bb) | (bb 37 ec 52))}
		$ConnectNamedPipe = {((fb d7 64 08) | (08 64 d7 fb))}
		$RegDeleteKeyValueA = {((2e dd e6 57) | (57 e6 dd 2e))}
		$CreatePipe = {((f4 48 e8 15) | (15 e8 48 f4))}
		$NtDelayExecution = {((3e b4 c5 ea) | (ea c5 b4 3e))}
		$RtlGetVersion = {((98 a2 d2 db) | (db d2 a2 98))}
		$NtOpenThread = {((4e b4 3c d1) | (d1 3c b4 4e))}
		$RegReplaceKeyA = {((64 33 7f c4) | (c4 7f 33 64))}
		$RtlCreateHeap = {((78 2a 7f 87) | (87 7f 2a 78))}
		$CheckRemoteDebuggerPresent = {((01 52 db 55) | (55 db 52 01))}
		$GetProcessIdOfThread = {((7f a8 88 5c) | (5c 88 a8 7f))}
		$SetForegroundWindow = {((54 63 b3 28) | (28 b3 63 54))}
		$SetWinEventHook = {((7a 30 ae 4b) | (4b ae 30 7a))}
		$RegisterHotKey = {((e5 e4 b8 e0) | (e0 b8 e4 e5))}
		$NtQueryInformationProcess = {((29 ec 66 60) | (60 66 ec 29))}
		$CreateRemoteThreadEx = {((ba 85 42 35) | (35 42 85 ba))}
		$OpenClipboard = {((1f 2b d6 5f) | (5f d6 2b 1f))}
		$RegEnumValueA = {((2a 52 8b 58) | (58 8b 52 2a))}
		$URLDownloadToCacheFile = {((77 16 7b 90) | (90 7b 16 77))}
		$LocalAlloc = {((33 2a 23 84) | (84 23 2a 33))}
		$ShowWindow = {((f2 d0 f7 0f) | (0f f7 d0 f2))}
		$VirtualQueryEx = {((fb ef 08 27) | (27 08 ef fb))}
		$NtQueueApcThread = {((36 66 e0 4b) | (4b e0 66 36))}
		$NtMakeTemporaryObject = {((7c 2e ff 8b) | (8b ff 2e 7c))}
		$VirtualAllocExNuma = {((e7 fd 2b 22) | (22 2b fd e7))}
		$RegOpenKeyA = {((20 26 94 59) | (59 94 26 20))}
		$EnumDesktopWindows = {((e3 43 80 30) | (30 80 43 e3))}
		$WaitForSingleObject = {((21 62 10 02) | (02 10 62 21))}
		$FindResourceExA = {((f1 70 1c b2) | (b2 1c 70 f1))}
		$CryptStringToBinary = {((40 d3 9b 27) | (27 9b d3 40))}
		$RegEnumKeyA = {((df 11 e7 40) | (40 e7 11 df))}
		$Select = {((ec 42 5b e2) | (e2 5b 42 ec))}
		$WNetEnumResourceA = {((d0 f9 97 f8) | (f8 97 f9 d0))}
		$EnumProcesses = {((93 eb 1d b4) | (b4 1d eb 93))}
		$Listen = {((f4 0b f8 fe) | (fe f8 0b f4))}
		$RegCreateKeyA = {((63 13 66 c9) | (c9 66 13 63))}
		$IsDebuggerPresent = {((65 5a cd 75) | (75 cd 5a 65))}
		$FindNextUrlCacheEntryA = {((3a 9b df de) | (de df 9b 3a))}
		$StartServiceA = {((89 73 1c f4) | (f4 1c 73 89))}
		$GetThreadContext = {((5d 25 b8 16) | (16 b8 25 5d))}
		$VirtualAlloc = {((ff e3 c3 de) | (de c3 e3 ff))}
		$Module32First = {((96 0a 6d 9d) | (9d 6d 0a 96))}
		$FindFirstUrlCacheEntryA = {((c5 89 ca 34) | (34 ca 89 c5))}
		$SleepEx = {((8f a4 92 a5) | (a5 92 a4 8f))}
		$MoveFileA = {((0a 5e e5 eb) | (eb e5 5e 0a))}
		$NtSetValueKey = {((51 21 96 02) | (02 96 21 51))}
		$SetWindowLongA = {((d1 be 37 61) | (61 37 be d1))}
		$MapViewOfFileEx = {((1b 4f 99 80) | (80 99 4f 1b))}
		$NtDuplicateObject = {((f5 5f ab b6) | (b6 ab 5f f5))}
		$GetKeyboardState = {((83 c1 33 ca) | (ca 33 c1 83))}
		$GetSystemTime = {((d7 da 3b 31) | (31 3b da d7))}
		$FindWindowExA = {((d3 da 56 cc) | (cc 56 da d3))}
		$RegQueryMultipleValuesA = {((ae 3b 1a a5) | (a5 1a 3b ae))}
		$DrawTextExA = {((27 93 1f ff) | (ff 1f 93 27))}
		$RegEnumKeyExA = {((50 03 54 3e) | (3e 54 03 50))}
		$QueueUserAPC = {((b3 fc ff 18) | (18 ff fc b3))}
		$RegSaveKeyA = {((95 b9 e0 87) | (87 e0 b9 95))}
		$CreateFileMappingA = {((7f 6d ac df) | (df ac 6d 7f))}
		$CryptDestroyKey = {((06 9c be 9b) | (9b be 9c 06))}
		$RegDeleteKeyExA = {((30 76 70 97) | (97 70 76 30))}
		$EnumResourceTypesA = {((51 52 d9 a9) | (a9 d9 52 51))}
		$RegSetKeyValueA = {((98 c1 e0 4e) | (4e e0 c1 98))}
		$timeSetEvent = {((14 bb 54 a6) | (a6 54 bb 14))}
		$RegSaveKeyExA = {((fa 02 ba 10) | (10 ba 02 fa))}
		$CountClipboardFormats = {((c4 86 e4 5f) | (5f e4 86 c4))}
		$HttpAddRequestHeaders = {((82 af 4b 5a) | (5a 4b af 82))}
		$NtQueueApcThreadEx2 = {((74 32 82 96) | (96 82 32 74))}
		$RegCopyTreeA = {((5c 43 aa c4) | (c4 aa 43 5c))}
		$ImpersonateLoggedOnUser = {((80 e8 99 74) | (74 99 e8 80))}
		$GetDriveTypeA = {((4f bd a1 84) | (84 a1 bd 4f))}
		$GetVersionExA = {((57 c8 95 9c) | (9c 95 c8 57))}
		$InternetReadFile = {((f0 64 70 92) | (92 70 64 f0))}
		$RegOpenCurrentUser = {((3f 2d c4 0e) | (0e c4 2d 3f))}
		$GetThreadLocale = {((43 8a 3f d4) | (d4 3f 8a 43))}
		$NtUnmapViewOfSection = {((39 71 1c d9) | (d9 1c 71 39))}
		$FindNextFileA = {((23 21 6b 34) | (34 6b 21 23))}
		$GetLogicalProcessorInformation = {((5b 20 79 e3) | (e3 79 20 5b))}
		$FlushEfsCache = {((f3 35 8d dc) | (dc 8d 35 f3))}
		$Closesocket = {((29 1b 6e 52) | (52 6e 1b 29))}
		$NetShareGetInfo = {((0a 4b 55 ef) | (ef 55 4b 0a))}
		$GetModuleHandleA = {((dc 53 da 36) | (36 da 53 dc))}
		$VirtualAlloc2FromApp = {((cd 0b 8e 80) | (80 8e 0b cd))}
		$MoveFileExA = {((a4 c3 ee eb) | (eb ee c3 a4))}
		$NtWaitForMultipleObjects = {((0e 0c fa 9f) | (9f fa 0c 0e))}
		$DeleteFileA = {((48 55 4a 7c) | (7c 4a 55 48))}
		$StartServiceCtrlDispatcherA = {((83 ef 93 e2) | (e2 93 ef 83))}
		$HttpOpenRequestA = {((60 89 1f 23) | (23 1f 89 60))}
		$GetThreadInformation = {((1e 6b 2d 3e) | (3e 2d 6b 1e))}
		$NtDeleteKey = {((ae 4b 7f 2b) | (2b 7f 4b ae))}
		$InternetWriteFile = {((c9 94 e4 8c) | (8c e4 94 c9))}
		$LoadLibraryA = {((ae 8c 32 fb) | (fb 32 8c ae))}
		$RegQueryValueExA = {((f8 d4 9a ef) | (ef 9a d4 f8))}
		$NtCreateProcessEx = {((4c ca 5a 0a) | (0a 5a ca 4c))}
		$GetForegroundWindow = {((1c 63 9f 43) | (43 9f 63 1c))}
		$NtQuerySystemEnvironmentValueEx = {((95 0f 73 53) | (53 73 0f 95))}
		$SizeOfResource = {((df 59 78 9f) | (9f 78 59 df))}
		$RegGetValueA = {((1f 84 9e 8e) | (8e 9e 84 1f))}
		$LdrLoadDll = {((5b 4c b0 df) | (df b0 4c 5b))}
		$NtResumeThread = {((4f fc 82 ad) | (ad 82 fc 4f))}
		$MapViewOfFile3 = {((8f 0c b5 e7) | (e7 b5 0c 8f))}
		$NtQueryTimer = {((f1 69 f2 3c) | (3c f2 69 f1))}
		$RtlCopyMemory = {((f9 14 03 7a) | (7a 03 14 f9))}
		$InternetConnectA = {((9b eb 1b 60) | (60 1b eb 9b))}
		$SetClipboardData = {((d1 35 e4 08) | (08 e4 35 d1))}
		$GetKeyState = {((ea 4d 59 dd) | (dd 59 4d ea))}
		$WriteProcessMemory = {((ef 43 06 66) | (66 06 43 ef))}
		$RtlSetProcessIsCritical = {((42 50 90 38) | (38 90 50 42))}
		$NetShareAdd = {((46 ef 4f 9b) | (9b 4f ef 46))}
		$NtResumeProcess = {((a3 74 63 c2) | (c2 63 74 a3))}
		$GetProcessHeaps = {((34 01 60 22) | (22 60 01 34))}
		$RegDeleteKeyTransactedA = {((64 37 72 a3) | (a3 72 37 64))}
		$ReadProcessMemory = {((8b c1 6a 31) | (31 6a c1 8b))}
		$GetNativeSystemInfo = {((d4 e9 7c c4) | (c4 7c e9 d4))}
		$ioctlsocket = {((cb c0 61 8a) | (8a 61 c0 cb))}
		$CreateProcessAsUserA = {((4c ca 66 ed) | (ed 66 ca 4c))}
		$PeekNamedPipe = {((b1 51 20 af) | (af 20 51 b1))}
		$SuspendThread = {((78 fb cb 75) | (75 cb fb 78))}
		$CallWindowProcA = {((90 ea bd 63) | (63 bd ea 90))}
		$OpenServiceA = {((72 9e 8f 57) | (57 8f 9e 72))}
		$SetTimer = {((ac da 98 75) | (75 98 da ac))}
		$MapViewOfFile2 = {((8f 0c b5 ef) | (ef b5 0c 8f))}
		$RegRestoreKeyA = {((45 37 7f 88) | (88 7f 37 45))}
		$InternetOpenUrlA = {((d1 48 b7 17) | (17 b7 48 d1))}
		$GetTempPathA = {((98 17 d5 ed) | (ed d5 17 98))}
		$NtAdjustPrivilegesToken = {((81 98 c4 b0) | (b0 c4 98 81))}
		$GetTickCount = {((04 96 c5 e2) | (e2 c5 96 04))}
		$RegSetValueExA = {((92 52 ea b2) | (b2 ea 52 92))}
		$NtCreateSection = {((3c d4 bd 65) | (65 bd d4 3c))}
		$SetPropA = {((7a 7f 20 ae) | (ae 20 7f 7a))}
		$GetModuleFileNameExA = {((3b b4 7b 31) | (31 7b b4 3b))}
		$PathFileExistsA = {((eb c1 01 a5) | (a5 01 c1 eb))}
		$SetFocus = {((38 0c e0 79) | (79 e0 0c 38))}
		$GetDCEx = {((2b 0c aa 4a) | (4a aa 0c 2b))}
		$WNetOpenEnumA = {((30 00 5a 9e) | (9e 5a 00 30))}
		$FindFirstFileA = {((40 e7 24 e3) | (e3 24 e7 40))}
		$AttachThreadInput = {((f2 e7 d8 d0) | (d0 d8 e7 f2))}
		$AdjustTokenPrivileges = {((c6 74 3b 57) | (57 3b 74 c6))}
		$EnumProcessModules = {((14 8d 3c 52) | (52 3c 8d 14))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0df50c2c-88a3-4f20-bf67-180fa25f298b
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
