api_hashes_rol5XorHash32

YARA detection rule by filescanio
Rule api_hashes_rol5XorHash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_rol5XorHash32 : hardened
{
	strings:
		$ControlService = {((cb c4 84 b9) | (b9 84 c4 cb))}
		$HttpSendRequestA = {((9d 79 b8 87) | (87 b8 79 9d))}
		$SetThreadPriority = {((ec 20 d8 8b) | (8b d8 20 ec))}
		$Recv = {((00 38 98 16) | (16 98 38 00))}
		$QueryPerformanceFrequency = {((6b 77 36 65) | (65 36 77 6b))}
		$RegDeleteValueA = {((e9 be 22 34) | (34 22 be e9))}
		$GetWindowsDirectoryA = {((51 c2 fe b4) | (b4 fe c2 51))}
		$CryptSetKeyParam = {((8e f2 97 79) | (79 97 f2 8e))}
		$RegCreateKeyExA = {((d0 29 c5 94) | (94 c5 29 d0))}
		$Module32Next = {((12 26 6d 0d) | (0d 6d 26 12))}
		$RegOpenUserClassesRoot = {((57 ef dc d2) | (d2 dc ef 57))}
		$NtReadVirtualMemoryEx = {((43 d2 9c 27) | (27 9c d2 43))}
		$InternetOpenA = {((08 15 48 ce) | (ce 48 15 08))}
		$URLOpenBlockingStream = {((6a ea a6 0e) | (0e a6 ea 6a))}
		$NtSetInformationThread = {((63 58 c0 06) | (06 c0 58 63))}
		$CreateFileA = {((cd d7 1a d4) | (d4 1a d7 cd))}
		$UnhookWindowsHookEx = {((8a 59 af 6c) | (6c af 59 8a))}
		$GetCurrentThreadId = {((f6 7e 12 d3) | (d3 12 7e f6))}
		$Accept = {((c4 00 1a 74) | (74 1a 00 c4))}
		$HeapReAlloc = {((4d 8b 7f 1f) | (1f 7f 8b 4d))}
		$WinExec = {((14 d3 6c de) | (de 6c d3 14))}
		$NtQueueApcThreadEx = {((8c dc e9 ef) | (ef e9 dc 8c))}
		$VirtualAllocFromApp = {((46 ab 5b f4) | (f4 5b ab 46))}
		$RegLoadKeyA = {((05 b0 df 3a) | (3a df b0 05))}
		$OutputDebugStringA = {((51 1b be 48) | (48 be 1b 51))}
		$GetFileAttributesA = {((7c e7 d4 df) | (df d4 e7 7c))}
		$SetWaitableTimer = {((8c 5c 5b 76) | (76 5b 5c 8c))}
		$SendMessageA = {((99 18 b7 b0) | (b0 b7 18 99))}
		$RegUnLoadKeyA = {((17 66 d6 3d) | (3d d6 66 17))}
		$SetEnvironmentVariableA = {((81 a0 cf bc) | (bc cf a0 81))}
		$VirtualAlloc2 = {((91 b1 46 46) | (46 46 b1 91))}
		$CryptProtectData = {((ba be a2 2d) | (2d a2 be ba))}
		$GetDesktopWindow = {((9b e4 ab 5d) | (5d ab e4 9b))}
		$RegGetKeySecurity = {((ea b9 41 70) | (70 41 b9 ea))}
		$GetDC = {((06 43 5c e3) | (e3 5c 43 06))}
		$LookupPrivilegeValueA = {((31 98 a4 f4) | (f4 a4 98 31))}
		$CryptGetHashParam = {((65 4b 21 fe) | (fe 21 4b 65))}
		$HeapAlloc = {((a6 27 d6 b3) | (b3 d6 27 a6))}
		$RegCloseKey = {((d8 c7 e4 da) | (da e4 c7 d8))}
		$CryptHashData = {((a8 59 fd bf) | (bf fd 59 a8))}
		$GlobalAlloc = {((9f b6 51 8b) | (8b 51 b6 9f))}
		$RegOverridePredefKey = {((03 f2 da cb) | (cb da f2 03))}
		$EnumSystemLocalesA = {((a4 b6 e7 db) | (db e7 b6 a4))}
		$GetProcessId = {((32 72 b2 cf) | (cf b2 72 32))}
		$RegLoadMUIStringA = {((ee 79 d3 cb) | (cb d3 79 ee))}
		$SearchPathA = {((16 f1 9f e9) | (e9 9f f1 16))}
		$FindClose = {((4e 07 d7 56) | (56 d7 07 4e))}
		$NtDeleteValueKey = {((f8 fa ab bf) | (bf ab fa f8))}
		$URLDownloadToFile = {((24 81 ce 3a) | (3a ce 81 24))}
		$Toolhelp32ReadProcessMemory = {((62 9c c9 17) | (17 c9 9c 62))}
		$GetProcAddress = {((e5 b6 b6 db) | (db b6 b6 e5))}
		$OpenProcessToken = {((f8 b0 c4 36) | (36 c4 b0 f8))}
		$HeapCreate = {((c1 1e 6c f1) | (f1 6c 1e c1))}
		$UuidFromStringA = {((8c 83 05 59) | (59 05 83 8c))}
		$VirtualProtectEx = {((55 6a 05 f0) | (f0 05 6a 55))}
		$GetSystemTimeAsFileTime = {((53 7d c7 39) | (39 c7 7d 53))}
		$GetModuleBaseNameA = {((7b 6b 42 4d) | (4d 42 6b 7b))}
		$lstrcatA = {((2f 10 09 9d) | (9d 09 10 2f))}
		$SetFileAttributesA = {((7e 67 d4 df) | (df d4 67 7e))}
		$FindResourceA = {((4c 5c 71 f3) | (f3 71 5c 4c))}
		$WaitForMultipleObjects = {((a5 95 0e 49) | (49 0e 95 a5))}
		$QueryPerformanceCounter = {((e4 15 59 d3) | (d3 59 15 e4))}
		$NtCreateThreadEx = {((f1 68 97 a3) | (a3 97 68 f1))}
		$NtContinue = {((1b 78 81 c6) | (c6 81 78 1b))}
		$IsWoW64Process = {((e8 f2 cd 7a) | (7a cd f2 e8))}
		$DnsQuery_A = {((ac 64 06 05) | (05 06 64 ac))}
		$VirtualProtectFromApp = {((32 6d de 7b) | (7b de 6d 32))}
		$GetAsyncKeyState = {((9d 61 0b 0a) | (0a 0b 61 9d))}
		$EncryptFileA = {((dd 61 2d 15) | (15 2d 61 dd))}
		$DuplicateToken = {((a4 cb 60 14) | (14 60 cb a4))}
		$CryptDeriveKey = {((48 1d c7 2c) | (2c c7 1d 48))}
		$LockResource = {((97 7b 4c 8c) | (8c 4c 7b 97))}
		$ResumeThread = {((96 22 8e 35) | (35 8e 22 96))}
		$WaitForSingleObjectEx = {((de 14 d9 99) | (99 d9 14 de))}
		$NtSuspendProcess = {((8a 8f ba ce) | (ce ba 8f 8a))}
		$NetShareCheck = {((9f 5b 93 19) | (19 93 5b 9f))}
		$OpenThread = {((6e b5 0b 77) | (77 0b b5 6e))}
		$URLOpenStream = {((09 c5 0b 79) | (79 0b c5 09))}
		$UnmapViewOfFile = {((f9 1c 1e 4a) | (4a 1e 1c f9))}
		$CreateFile2 = {((cd d7 1a 87) | (87 1a d7 cd))}
		$DeleteService = {((7e 26 7f 37) | (37 7f 26 7e))}
		$GetThreadId = {((e3 f1 ca fe) | (fe ca f1 e3))}
		$RegDeleteKeyA = {((bd 74 fd 3f) | (3f fd 74 bd))}
		$CreateTimerQueueTimer = {((f6 64 5d 3b) | (3b 5d 64 f6))}
		$SetProcessDEPPolicy = {((25 52 33 74) | (74 33 52 25))}
		$CreateServiceA = {((b0 5f e6 81) | (81 e6 5f b0))}
		$ExitWindowsEx = {((23 60 b4 8d) | (8d b4 60 23))}
		$NtMapViewOfSection = {((54 a6 55 05) | (05 55 a6 54))}
		$NtTerminateThread = {((b9 fc 87 30) | (30 87 fc b9))}
		$Process32First = {((b4 55 96 67) | (67 96 55 b4))}
		$RegCreateKeyTransactedA = {((2d 8b 4f 5d) | (5d 4f 8b 2d))}
		$GetUserNameA = {((90 cb ce 40) | (40 ce cb 90))}
		$MapVirtualKeyA = {((ad 21 4a 20) | (20 4a 21 ad))}
		$WNetCloseEnum = {((66 f9 d6 b1) | (b1 d6 f9 66))}
		$InternetReadFileExA = {((96 80 ed 03) | (03 ed 80 96))}
		$GetComputerNameA = {((a4 e8 6f d6) | (d6 6f e8 a4))}
		$RegFlushKey = {((ec c1 64 f2) | (f2 64 c1 ec))}
		$VirtualAllocEx = {((36 28 c2 4a) | (4a c2 28 36))}
		$GetSystemDefaultLangId = {((6e 62 b6 ce) | (ce b6 62 6e))}
		$SetFileTime = {((9f ab 7e ef) | (ef 7e ab 9f))}
		$SendNotifyMessageA = {((64 af c3 6a) | (6a c3 af 64))}
		$LookupAccountNameA = {((52 3d 56 5f) | (5f 56 3d 52))}
		$NetShareEnum = {((94 f9 c6 95) | (95 c6 f9 94))}
		$IcmpSendEcho = {((af 72 d2 ee) | (ee d2 72 af))}
		$DebugActiveProcessStop = {((2a c4 ba 24) | (24 ba c4 2a))}
		$NtCreateFile = {((98 be b8 d5) | (d5 b8 be 98))}
		$DecryptFileA = {((dd cd 2d 15) | (15 2d cd dd))}
		$GetRawInputData = {((95 f9 19 80) | (80 19 f9 95))}
		$BringWindowToTop = {((fb 24 1c ff) | (ff 1c 24 fb))}
		$NetShareSetInfo = {((75 59 7e d6) | (d6 7e 59 75))}
		$GetLogicalDrives = {((39 07 35 6e) | (6e 35 07 39))}
		$WriteFile = {((ae 62 dd 6f) | (6f dd 62 ae))}
		$BitBlt = {((c2 ab 85 f4) | (f4 85 ab c2))}
		$SendMessageTimeoutA = {((54 a3 e7 d7) | (d7 e7 a3 54))}
		$GetCurrentProcess = {((8a 60 e2 6e) | (6e e2 60 8a))}
		$RegDeleteTreeA = {((af 64 57 16) | (16 57 64 af))}
		$CreateProcessWithTokenW = {((da 4d 3a 6c) | (6c 3a 4d da))}
		$FindWindowA = {((15 46 ff bc) | (bc ff 46 15))}
		$CopyFileA = {((f4 55 5c a5) | (a5 5c 55 f4))}
		$FtpPutFileA = {((af c3 cf 5c) | (5c cf c3 af))}
		$NtOpenProcess = {((39 72 7c 79) | (79 7c 72 39))}
		$Send = {((00 38 19 a4) | (a4 19 38 00))}
		$EnumDeviceDrivers = {((91 99 b7 9e) | (9e b7 99 91))}
		$Process32Next = {((9d a6 9d f7) | (f7 9d a6 9d))}
		$GetWindowDC = {((9b e6 87 41) | (41 87 e6 9b))}
		$CryptDecrypt = {((fc 4f b9 cd) | (cd b9 4f fc))}
		$ReadFile = {((84 72 aa 6c) | (6c aa 72 84))}
		$VirtualProtect = {((4a 15 5a 82) | (82 5a 15 4a))}
		$OpenProcess = {((e3 72 7c 7f) | (7f 7c 72 e3))}
		$WaitForMultipleObjectsEx = {((54 39 2a 4e) | (4e 2a 39 54))}
		$Inet_addr = {((af c1 76 9b) | (9b 76 c1 af))}
		$WSAStartup = {((2e 26 4e c4) | (c4 4e 26 2e))}
		$Bind = {((00 30 a9 a4) | (a4 a9 30 00))}
		$GetTempFileNameA = {((bf e8 7c 3d) | (3d 7c e8 bf))}
		$CreateMutexExA = {((bd 67 7d d5) | (d5 7d 67 bd))}
		$DeviceIoControl = {((4d db 16 21) | (21 16 db 4d))}
		$CryptDestroyHash = {((62 3a 5e c1) | (c1 5e 3a 62))}
		$CryptEncrypt = {((aa 4f b9 cd) | (cd b9 4f aa))}
		$NtSetContextThread = {((e5 39 ff 37) | (37 ff 39 e5))}
		$CryptReleaseContext = {((fd 79 56 a7) | (a7 56 79 fd))}
		$StretchBlt = {((ae 0b 92 7d) | (7d 92 0b ae))}
		$NtWaitForSingleObject = {((50 77 83 ef) | (ef 83 77 50))}
		$LoadLibraryExA = {((84 00 f1 b3) | (b3 f1 00 84))}
		$PeekMessageA = {((98 99 d8 b0) | (b0 d8 99 98))}
		$WNetAddConnectionA = {((fc 79 89 0c) | (0c 89 79 fc))}
		$NtCreateThread = {((de fc 5a 26) | (26 5a fc de))}
		$ShellExecuteExA = {((4a cf dc 47) | (47 dc cf 4a))}
		$GetMessageA = {((a0 91 c7 b0) | (b0 c7 91 a0))}
		$GetCurrentHwProfileA = {((24 68 fc 0d) | (0d fc 68 24))}
		$PostThreadMessageA = {((17 f5 d2 5e) | (5e d2 f5 17))}
		$RegOpenKeyExA = {((43 7c 88 55) | (55 88 7c 43))}
		$CreateWaitableTimer = {((0e 79 cf 15) | (15 cf 79 0e))}
		$NtSetInformationProcess = {((5e cb 12 5e) | (5e 12 cb 5e))}
		$InternetSetOptionA = {((f9 66 8e b8) | (b8 8e 66 f9))}
		$GetClipboardData = {((a5 da ca 2f) | (2f ca da a5))}
		$HttpSendRequestExA = {((e6 e2 01 14) | (14 01 e2 e6))}
		$CreateProcessA = {((4b 09 a4 5c) | (5c a4 09 4b))}
		$CreateToolhelp32Snapshot = {((bb 16 53 ea) | (ea 53 16 bb))}
		$GetProcessHeap = {((ca cb b4 99) | (99 b4 cb ca))}
		$MapVirtualKeyExA = {((85 28 9d d5) | (d5 9d 28 85))}
		$NtTerminateProcess = {((0a 43 f4 85) | (85 f4 43 0a))}
		$CallNextHookEx = {((f1 7b 86 c5) | (c5 86 7b f1))}
		$TerminateProcess = {((07 f7 f4 85) | (85 f4 f7 07))}
		$GetIpNetTable = {((ec 2c 56 8a) | (8a 56 2c ec))}
		$SetThreadToken = {((e4 ab 51 1e) | (1e 51 ab e4))}
		$SetCurrentDirectory = {((9f ea 50 cf) | (cf 50 ea 9f))}
		$GetFileTime = {((9f fb 7e ef) | (ef 7e fb 9f))}
		$CreateRemoteThread = {((ca 30 64 53) | (53 64 30 ca))}
		$KeInsertQueueApc = {((55 7a 7c 62) | (62 7c 7a 55))}
		$SetWindowsHookExA = {((7e 29 ba 0b) | (0b ba 29 7e))}
		$EnumWindows = {((15 4a 04 e6) | (e6 04 4a 15))}
		$NtSetSystemEnvironmentValueEx = {((6d 0e 05 74) | (74 05 0e 6d))}
		$GetKeynameTextA = {((f9 68 3a ff) | (ff 3a 68 f9))}
		$CryptCreateHash = {((07 b9 83 1b) | (1b 83 b9 07))}
		$CreateThread = {((9e fc 5a fd) | (fd 5a fc 9e))}
		$GetCurrentThread = {((e5 fd 9f 87) | (87 9f fd e5))}
		$EnumResourceTypesExA = {((5b e2 94 4c) | (4c 94 e2 5b))}
		$OpenSCManagerA = {((a9 14 1a 88) | (88 1a 14 a9))}
		$NtWriteVirtualMemory = {((57 b0 91 d1) | (d1 91 b0 57))}
		$WSASocketA = {((18 0a 8a f5) | (f5 8a 0a 18))}
		$SetWindowLongPtrA = {((bc a4 7f b2) | (b2 7f a4 bc))}
		$CryptAcquireContextA = {((77 0a f0 53) | (53 f0 0a 77))}
		$Thread32Next = {((5e b8 bd 65) | (65 bd b8 5e))}
		$RegisterRawInputDevices = {((ca 99 b6 6a) | (6a b6 99 ca))}
		$Gethostbyname = {((80 fb e5 46) | (46 e5 fb 80))}
		$GetLogicalProcessorInformationEx = {((69 5e 37 8e) | (8e 37 5e 69))}
		$CreateWindowExA = {((2f 96 d7 10) | (10 d7 96 2f))}
		$GetTickCount64 = {((72 bb 96 7c) | (7c 96 bb 72))}
		$SendMessageCallbackA = {((c6 a6 b0 8b) | (8b b0 a6 c6))}
		$WNetAddConnection2A = {((8f 31 2b 9e) | (9e 2b 31 8f))}
		$ShellExecuteA = {((c9 92 b3 f0) | (f0 b3 92 c9))}
		$CryptGenRandom = {((7f 68 79 7f) | (7f 79 68 7f))}
		$RegConnectRegistryA = {((02 cd 35 6b) | (6b 35 cd 02))}
		$CryptBinaryToString = {((05 c8 0e df) | (df 0e c8 05))}
		$RtlMoveMemory = {((87 da fe 97) | (97 fe da 87))}
		$CopyFile2 = {((f4 55 5c f6) | (f6 5c 55 f4))}
		$TimeGetTime = {((0c a6 e7 f4) | (f4 e7 a6 0c))}
		$Thread32First = {((d7 91 84 3f) | (3f 84 91 d7))}
		$PostMessageA = {((98 b3 07 b0) | (b0 07 b3 98))}
		$WSACleanup = {((1e 6f a6 c0) | (c0 a6 6f 1e))}
		$NtShutdownSystem = {((da f7 dd 8e) | (8e dd f7 da))}
		$GetModuleFileNameA = {((bb 6b 46 0a) | (0a 46 6b bb))}
		$Socket = {((e0 c0 20 d4) | (d4 20 c0 e0))}
		$NtCreateUserProcess = {((27 7a 95 1b) | (1b 95 7a 27))}
		$GetCurrentProcessId = {((83 89 b7 6d) | (6d b7 89 83))}
		$InternetCloseHandle = {((54 10 45 3f) | (3f 45 10 54))}
		$OpenFileMappingA = {((75 9f b6 3d) | (3d b6 9f 75))}
		$NtQueryDirectoryFile = {((88 b0 5d 1c) | (1c 5d b0 88))}
		$GetAdaptersInfo = {((d2 19 7e 1b) | (1b 7e 19 d2))}
		$MapViewOfFile = {((f9 1c 03 d6) | (d6 03 1c f9))}
		$TerminateThread = {((b9 91 27 30) | (30 27 91 b9))}
		$ControlServiceExA = {((42 5d 7e 83) | (83 7e 5d 42))}
		$CreateProcessInternal = {((36 25 96 f5) | (f5 96 25 36))}
		$CreateMutexA = {((ad 2f 59 d8) | (d8 59 2f ad))}
		$WSAIoctl = {((04 a6 01 48) | (48 01 a6 04))}
		$RegOpenKeyTransactedA = {((78 c6 8e ce) | (ce 8e c6 78))}
		$Connect = {((18 d6 98 0c) | (0c 98 d6 18))}
		$RegQueryInfoKeyA = {((61 dd a8 9b) | (9b a8 dd 61))}
		$RegSetKeySecurity = {((ea b9 41 58) | (58 41 b9 ea))}
		$NtClose = {((6e 07 b2 1e) | (1e b2 07 6e))}
		$Sleep = {((07 07 98 d0) | (d0 98 07 07))}
		$NtProtectVirtualMemory = {((4c b6 2f 7c) | (7c 2f b6 4c))}
		$NtReadVirtualMemory = {((3f d0 f4 a4) | (a4 f4 d0 3f))}
		$Gethostname = {((20 e6 5e 9e) | (9e 5e e6 20))}
		$CopyFileExA = {((55 72 88 b0) | (b0 88 72 55))}
		$Wow64SetThreadContext = {((37 e8 df a5) | (a5 df e8 37))}
		$EnumProcessModulesEx = {((d9 7f d2 d2) | (d2 d2 7f d9))}
		$GetSystemDirectoryA = {((62 99 2b 68) | (68 2b 99 62))}
		$NtCreateProcess = {((ea 58 56 49) | (49 56 58 ea))}
		$SetThreadContext = {((6d 1c d8 e3) | (e3 d8 1c 6d))}
		$DnsQueryEx = {((ac 64 05 5c) | (5c 05 64 ac))}
		$LoadResource = {((97 7b 03 8c) | (8c 03 7b 97))}
		$NtAllocateVirtualMemory = {((34 ba bf c0) | (c0 bf ba 34))}
		$ConnectNamedPipe = {((5f 78 44 6c) | (6c 44 78 5f))}
		$RegDeleteKeyValueA = {((57 5d 31 3b) | (3b 31 5d 57))}
		$CreatePipe = {((ae 65 bb 55) | (55 bb 65 ae))}
		$NtDelayExecution = {((e6 e3 82 99) | (99 82 e3 e6))}
		$RtlGetVersion = {((56 a4 af 34) | (34 af a4 56))}
		$NtOpenThread = {((58 65 0b 77) | (77 0b 65 58))}
		$RegReplaceKeyA = {((e2 20 c8 db) | (db c8 20 e2))}
		$RtlCreateHeap = {((b5 d9 89 67) | (67 89 d9 b5))}
		$CheckRemoteDebuggerPresent = {((cb df bf eb) | (eb bf df cb))}
		$GetProcessIdOfThread = {((1c 0a 54 17) | (17 54 0a 1c))}
		$SetForegroundWindow = {((4a 34 20 dd) | (dd 20 34 4a))}
		$SetWinEventHook = {((e1 5c 0b 2f) | (2f 0b 5c e1))}
		$RegisterHotKey = {((34 e1 b7 0f) | (0f b7 e1 34))}
		$NtQueryInformationProcess = {((87 6c d1 35) | (35 d1 6c 87))}
		$CreateRemoteThreadEx = {((c1 91 43 f0) | (f0 43 91 c1))}
		$OpenClipboard = {((6f 8f aa 58) | (58 aa 8f 6f))}
		$RegEnumValueA = {((b9 37 15 75) | (75 15 37 b9))}
		$URLDownloadToCacheFile = {((a8 2b af 3a) | (3a af 2b a8))}
		$LocalAlloc = {((9e 2a 51 83) | (83 51 2a 9e))}
		$ShowWindow = {((28 a8 96 f2) | (f2 96 a8 28))}
		$VirtualQueryEx = {((04 b6 2a 4e) | (4e 2a b6 04))}
		$NtQueueApcThread = {((4d e3 37 39) | (39 37 e3 4d))}
		$NtMakeTemporaryObject = {((c9 ee 89 8d) | (8d 89 ee c9))}
		$VirtualAllocExNuma = {((24 95 bb 4d) | (4d bb 95 24))}
		$RegOpenKeyA = {((cd 10 df 25) | (25 df 10 cd))}
		$EnumDesktopWindows = {((70 3c ed 80) | (80 ed 3c 70))}
		$WaitForSingleObject = {((50 77 85 35) | (35 85 77 50))}
		$FindResourceExA = {((71 c7 d2 50) | (50 d2 c7 71))}
		$CryptStringToBinary = {((f8 35 b3 62) | (62 b3 35 f8))}
		$RegEnumKeyA = {((6d 20 df 72) | (72 df 20 6d))}
		$Select = {((e0 67 98 14) | (14 98 67 e0))}
		$WNetEnumResourceA = {((7f c5 38 5b) | (5b 38 c5 7f))}
		$EnumProcesses = {((66 b1 93 5e) | (5e 93 b1 66))}
		$Listen = {((de a8 5c ce) | (ce 5c a8 de))}
		$RegCreateKeyA = {((bd 74 0a 76) | (76 0a 74 bd))}
		$IsDebuggerPresent = {((f9 12 1e f4) | (f4 1e 12 f9))}
		$FindNextUrlCacheEntryA = {((06 fd 90 53) | (53 90 fd 06))}
		$StartServiceA = {((a8 df 37 47) | (47 37 df a8))}
		$GetThreadContext = {((6d 1c 78 e3) | (e3 78 1c 6d))}
		$VirtualAlloc = {((a4 8d 8a 33) | (33 8a 8d a4))}
		$Module32First = {((44 4b 89 36) | (36 89 4b 44))}
		$FindFirstUrlCacheEntryA = {((0e 13 56 26) | (26 56 13 0e))}
		$SleepEx = {((1e 63 4c c4) | (c4 4c 63 1e))}
		$MoveFileA = {((4c 55 52 a4) | (a4 52 55 4c))}
		$NtSetValueKey = {((44 a3 f7 77) | (77 f7 a3 44))}
		$SetWindowLongA = {((43 27 79 5a) | (5a 79 27 43))}
		$MapViewOfFileEx = {((70 0f 57 3c) | (3c 57 0f 70))}
		$NtDuplicateObject = {((af d1 23 40) | (40 23 d1 af))}
		$GetKeyboardState = {((cc 60 87 5f) | (5f 87 60 cc))}
		$GetSystemTime = {((8f b5 b3 46) | (46 b3 b5 8f))}
		$FindWindowExA = {((1b fe ef 34) | (34 ef fe 1b))}
		$RegQueryMultipleValuesA = {((e7 9c ea d1) | (d1 ea 9c e7))}
		$DrawTextExA = {((cc 25 b9 c4) | (c4 b9 25 cc))}
		$RegEnumKeyExA = {((83 7d d6 d5) | (d5 d6 7d 83))}
		$QueueUserAPC = {((99 30 5c 56) | (56 5c 30 99))}
		$RegSaveKeyA = {((ab a0 df c1) | (c1 df a0 ab))}
		$CreateFileMappingA = {((c9 8d e2 5f) | (5f e2 8d c9))}
		$CryptDestroyKey = {((4b 11 de 7f) | (7f de 11 4b))}
		$RegDeleteKeyExA = {((d3 f4 e1 94) | (94 e1 f4 d3))}
		$EnumResourceTypesA = {((cb 56 f8 a2) | (a2 f8 56 cb))}
		$RegSetKeyValueA = {((e2 3d 2c bb) | (bb 2c 3d e2))}
		$timeSetEvent = {((95 c3 5f 35) | (35 5f c3 95))}
		$RegSaveKeyExA = {((83 7f 19 cf) | (cf 19 7f 83))}
		$CountClipboardFormats = {((30 10 5e 19) | (19 5e 10 30))}
		$HttpAddRequestHeaders = {((7b 19 75 d0) | (d0 75 19 7b))}
		$NtQueueApcThreadEx2 = {((9b 9d 3d c3) | (c3 3d 9d 9b))}
		$RegCopyTreeA = {((cd e0 18 a5) | (a5 18 e0 cd))}
		$ImpersonateLoggedOnUser = {((f9 7d 31 7e) | (7e 31 7d f9))}
		$GetDriveTypeA = {((0e 21 bd 92) | (92 bd 21 0e))}
		$GetVersionExA = {((57 98 3d eb) | (eb 3d 98 57))}
		$InternetReadFile = {((ec c5 2d 02) | (02 2d c5 ec))}
		$RegOpenCurrentUser = {((f3 df b2 7d) | (7d b2 df f3))}
		$GetThreadLocale = {((a5 6e 36 f9) | (f9 36 6e a5))}
		$NtUnmapViewOfSection = {((87 dc 55 33) | (33 55 dc 87))}
		$FindNextFileA = {((bb 61 d1 f1) | (f1 d1 61 bb))}
		$GetLogicalProcessorInformation = {((d5 9a 57 8e) | (8e 57 9a d5))}
		$FlushEfsCache = {((37 db 0a 52) | (52 0a db 37))}
		$Closesocket = {((a1 41 cc 55) | (55 cc 41 a1))}
		$NetShareGetInfo = {((75 59 7e d3) | (d3 7e 59 75))}
		$GetModuleHandleA = {((22 ce 52 5d) | (5d 52 ce 22))}
		$VirtualAlloc2FromApp = {((ef 4d 38 5d) | (5d 38 4d ef))}
		$MoveFileExA = {((55 4a 8e 50) | (50 8e 4a 55))}
		$NtWaitForMultipleObjects = {((a6 f8 0e 49) | (49 0e f8 a6))}
		$DeleteFileA = {((cd c9 f3 f4) | (f4 f3 c9 cd))}
		$StartServiceCtrlDispatcherA = {((8e 55 1b 3c) | (3c 1b 55 8e))}
		$HttpOpenRequestA = {((93 2c d2 87) | (87 d2 2c 93))}
		$GetThreadInformation = {((65 75 50 94) | (94 50 75 65))}
		$NtDeleteKey = {((cc c5 c7 ea) | (ea c7 c5 cc))}
		$InternetWriteFile = {((b8 92 30 a2) | (a2 30 92 b8))}
		$LoadLibraryA = {((b4 a1 00 3b) | (3b 00 a1 b4))}
		$RegQueryValueExA = {((b4 7a a8 40) | (40 a8 7a b4))}
		$NtCreateProcessEx = {((61 59 2b 71) | (71 2b 59 61))}
		$GetForegroundWindow = {((1a 34 20 dd) | (dd 20 34 1a))}
		$NtQuerySystemEnvironmentValueEx = {((9b 67 f5 ae) | (ae f5 67 9b))}
		$SizeOfResource = {((0c 52 c1 6c) | (6c c1 52 0c))}
		$RegGetValueA = {((d2 bf 5c f4) | (f4 5c bf d2))}
		$LdrLoadDll = {((d8 2e 7a 67) | (67 7a 2e d8))}
		$NtResumeThread = {((d6 22 8e ee) | (ee 8e 22 d6))}
		$MapViewOfFile3 = {((23 80 7a ec) | (ec 7a 80 23))}
		$NtQueryTimer = {((43 ab 6e e6) | (e6 6e ab 43))}
		$RtlCopyMemory = {((87 db 3e a0) | (a0 3e db 87))}
		$InternetConnectA = {((72 64 86 8c) | (8c 86 64 72))}
		$SetClipboardData = {((a5 da 6a 2f) | (2f 6a da a5))}
		$GetKeyState = {((b4 9b 5d a4) | (a4 5d 9b b4))}
		$WriteProcessMemory = {((2a 46 61 70) | (70 61 46 2a))}
		$RtlSetProcessIsCritical = {((27 db b5 b0) | (b0 b5 db 27))}
		$NetShareAdd = {((c4 a7 df 66) | (66 df a7 c4))}
		$NtResumeProcess = {((f1 82 cf 48) | (48 cf 82 f1))}
		$GetProcessHeaps = {((59 76 93 4a) | (4a 93 76 59))}
		$RegDeleteKeyTransactedA = {((f0 af 4f 5e) | (5e 4f af f0))}
		$ReadProcessMemory = {((24 a6 04 32) | (32 04 a6 24))}
		$GetNativeSystemInfo = {((f6 a8 46 85) | (85 46 a8 f6))}
		$ioctlsocket = {((e1 69 a0 6f) | (6f a0 69 e1))}
		$CreateProcessAsUserA = {((f3 aa 73 36) | (36 73 aa f3))}
		$PeekNamedPipe = {((bf 60 a7 71) | (71 a7 60 bf))}
		$SuspendThread = {((e5 fa fe 2a) | (2a fe fa e5))}
		$CallWindowProcA = {((de e9 e5 3e) | (3e e5 e9 de))}
		$OpenServiceA = {((95 19 cd 40) | (40 cd 19 95))}
		$SetTimer = {((af 75 3b 53) | (53 3b 75 af))}
		$MapViewOfFile2 = {((23 80 7a ed) | (ed 7a 80 23))}
		$RegRestoreKeyA = {((40 20 cb 18) | (18 cb 20 40))}
		$InternetOpenUrlA = {((a4 6c c1 eb) | (eb c1 6c a4))}
		$GetTempPathA = {((95 2b aa 52) | (52 aa 2b 95))}
		$NtAdjustPrivilegesToken = {((ad 14 14 2e) | (2e 14 14 ad))}
		$GetTickCount = {((22 1c ae e4) | (e4 ae 1c 22))}
		$RegSetValueExA = {((fd 23 cc 2b) | (2b cc 23 fd))}
		$NtCreateSection = {((04 93 e5 d4) | (d4 e5 93 04))}
		$SetPropA = {((af 38 b1 e0) | (e0 b1 38 af))}
		$GetModuleFileNameExA = {((ad 18 35 8c) | (8c 35 18 ad))}
		$PathFileExistsA = {((c3 3d 0d f5) | (f5 0d 3d c3))}
		$SetFocus = {((ae 56 01 52) | (52 01 56 ae))}
		$GetDCEx = {((0d 73 80 c1) | (c1 80 73 0d))}
		$WNetOpenEnumA = {((dc fc 35 5f) | (5f 35 fc dc))}
		$FindFirstFileA = {((88 c9 96 87) | (87 96 c9 88))}
		$AttachThreadInput = {((8b 19 02 20) | (20 02 19 8b))}
		$AdjustTokenPrivileges = {((71 15 da 7d) | (7d da 15 71))}
		$EnumProcessModules = {((82 b6 5f f7) | (f7 5f b6 82))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f1cd0d8e-41af-42a7-a451-7105ddd15a8a
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
