api_hashes_rol8Xor0xB0D4D06Hash32

YARA detection rule by filescanio
Rule api_hashes_rol8Xor0xB0D4D06Hash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_rol8Xor0xB0D4D06Hash32 : hardened
{
	strings:
		$ControlService = {((ce e8 4f 7b) | (7b 4f e8 ce))}
		$HttpSendRequestA = {((26 0d 9c 3e) | (3e 9c 0d 26))}
		$SetThreadPriority = {((34 39 52 70) | (70 52 39 34))}
		$Recv = {((1c 0b 58 ae) | (ae 58 0b 1c))}
		$QueryPerformanceFrequency = {((54 c2 6a 79) | (79 6a c2 54))}
		$RegDeleteValueA = {((f0 10 69 55) | (55 69 10 f0))}
		$GetWindowsDirectoryA = {((2a 2a 61 b2) | (b2 61 2a 2a))}
		$CryptSetKeyParam = {((5c c7 64 29) | (29 64 c7 5c))}
		$RegCreateKeyExA = {((f9 2a 60 49) | (49 60 2a f9))}
		$Module32Next = {((17 dd 96 a4) | (a4 96 dd 17))}
		$RegOpenUserClassesRoot = {((c9 32 39 81) | (81 39 32 c9))}
		$NtReadVirtualMemoryEx = {((da 6f b7 37) | (37 b7 6f da))}
		$InternetOpenA = {((33 0b c1 71) | (71 c1 0b 33))}
		$URLOpenBlockingStream = {((52 39 cc 8e) | (8e cc 39 52))}
		$NtSetInformationThread = {((6f f5 06 8e) | (8e 06 f5 6f))}
		$CreateFileA = {((5e 24 53 43) | (43 53 24 5e))}
		$UnhookWindowsHookEx = {((91 c9 52 8e) | (8e 52 c9 91))}
		$GetCurrentThreadId = {((44 60 6f 9a) | (9a 6f 60 44))}
		$Accept = {((0d db 4b 52) | (52 4b db 0d))}
		$HeapReAlloc = {((51 24 59 64) | (64 59 24 51))}
		$WinExec = {((cf 3e 42 48) | (48 42 3e cf))}
		$NtQueueApcThreadEx = {((18 79 66 94) | (94 66 79 18))}
		$VirtualAllocFromApp = {((1d df 67 74) | (74 67 df 1d))}
		$RegLoadKeyA = {((52 38 6c 40) | (40 6c 38 52))}
		$OutputDebugStringA = {((09 08 79 7d) | (7d 79 08 09))}
		$GetFileAttributesA = {((39 43 5a 0e) | (0e 5a 43 39))}
		$SetWaitableTimer = {((33 24 52 db) | (db 52 24 33))}
		$SendMessageA = {((2b 02 58 ab) | (ab 58 02 2b))}
		$RegUnLoadKeyA = {((02 32 cb 61) | (61 cb 32 02))}
		$SetEnvironmentVariableA = {((fe 57 ae 6f) | (6f ae 57 fe))}
		$VirtualAlloc2 = {((18 2d 10 d9) | (d9 10 2d 18))}
		$CryptProtectData = {((5a 17 6f 12) | (12 6f 17 5a))}
		$GetDesktopWindow = {((ce 2e 66 49) | (49 66 2e ce))}
		$RegGetKeySecurity = {((c5 38 51 28) | (28 51 38 c5))}
		$GetDC = {((1a 1d 85 43) | (43 85 1d 1a))}
		$LookupPrivilegeValueA = {((31 c5 44 47) | (47 44 c5 31))}
		$CryptGetHashParam = {((15 37 0c 81) | (81 0c 37 15))}
		$HeapAlloc = {((17 1e 26 43) | (43 26 1e 17))}
		$RegCloseKey = {((5e 3f 53 6a) | (6a 53 3f 5e))}
		$CryptHashData = {((1c 02 aa 74) | (74 aa 02 1c))}
		$GlobalAlloc = {((53 0e 53 40) | (40 53 0e 53))}
		$RegOverridePredefKey = {((48 38 78 5d) | (5d 78 38 48))}
		$EnumSystemLocalesA = {((40 7f 54 71) | (71 54 7f 40))}
		$GetProcessId = {((36 32 45 9b) | (9b 45 32 36))}
		$RegLoadMUIStringA = {((09 15 1b 09) | (09 1b 15 09))}
		$SearchPathA = {((78 20 68 62) | (62 68 20 78))}
		$FindClose = {((17 06 14 65) | (65 14 06 17))}
		$NtDeleteValueKey = {((3d 11 59 dd) | (dd 59 11 3d))}
		$URLDownloadToFile = {((3c 15 d2 6d) | (6d d2 15 3c))}
		$Toolhelp32ReadProcessMemory = {((dc 4a 5f 1d) | (1d 5f 4a dc))}
		$GetProcAddress = {((17 d9 70 8e) | (8e 70 d9 17))}
		$OpenProcessToken = {((60 3b 7c 33) | (33 7c 3b 60))}
		$HeapCreate = {((13 45 5e 5e) | (5e 5e 45 13))}
		$UuidFromStringA = {((8d cb 62 68) | (68 62 cb 8d))}
		$VirtualProtectEx = {((54 17 42 7c) | (7c 42 17 54))}
		$GetSystemTimeAsFileTime = {((ea 21 30 13) | (13 30 21 ea))}
		$GetModuleBaseNameA = {((3d 75 54 57) | (57 54 75 3d))}
		$lstrcatA = {((28 11 51 18) | (18 51 11 28))}
		$SetFileAttributesA = {((39 4f 7e 0e) | (0e 7e 4f 39))}
		$FindResourceA = {((39 1e bb 6a) | (6a bb 1e 39))}
		$WaitForMultipleObjects = {((5a e1 9a 69) | (69 9a e1 5a))}
		$QueryPerformanceCounter = {((39 24 07 85) | (85 07 24 39))}
		$NtCreateThreadEx = {((34 02 6e dc) | (dc 6e 02 34))}
		$NtContinue = {((17 79 99 61) | (61 99 79 17))}
		$IsWoW64Process = {((8e cf 57 77) | (77 57 cf 8e))}
		$DnsQuery_A = {((05 4b 75 77) | (77 75 4b 05))}
		$VirtualProtectFromApp = {((2c 16 91 35) | (35 91 16 2c))}
		$GetAsyncKeyState = {((2c 28 74 47) | (47 74 28 2c))}
		$EncryptFileA = {((3a 1d 65 98) | (98 65 1d 3a))}
		$DuplicateToken = {((19 fb 4c 66) | (66 4c fb 19))}
		$CryptDeriveKey = {((22 d3 95 78) | (78 95 d3 22))}
		$LockResource = {((3c 1a 50 80) | (80 50 1a 3c))}
		$ResumeThread = {((3d 18 5d a2) | (a2 5d 18 3d))}
		$WaitForSingleObjectEx = {((3a dc 71 70) | (70 71 dc 3a))}
		$NtSuspendProcess = {((5a 2b 74 d8) | (d8 74 2b 5a))}
		$NetShareCheck = {((06 2c b6 6e) | (6e b6 2c 06))}
		$OpenThread = {((12 42 75 55) | (55 75 42 12))}
		$URLOpenStream = {((31 04 54 87) | (87 54 04 31))}
		$UnmapViewOfFile = {((e7 65 6d 50) | (50 6d 65 e7))}
		$CreateFile2 = {((5e 24 00 10) | (10 00 24 5e))}
		$DeleteService = {((31 2d bb 7f) | (7f bb 2d 31))}
		$GetThreadId = {((5b 18 66 4f) | (4f 66 18 5b))}
		$RegDeleteKeyA = {((18 36 b7 59) | (59 b7 36 18))}
		$CreateTimerQueueTimer = {((33 55 b8 11) | (11 b8 55 33))}
		$SetProcessDEPPolicy = {((04 3f 04 71) | (71 04 3f 04))}
		$CreateServiceA = {((14 c2 65 6b) | (6b 65 c2 14))}
		$ExitWindowsEx = {((33 cb b6 35) | (35 b6 cb 33))}
		$NtMapViewOfSection = {((1a 8f b2 76) | (76 b2 8f 1a))}
		$NtTerminateThread = {((21 1e 22 76) | (76 22 1e 21))}
		$Process32First = {((c3 13 aa 72) | (72 aa 13 c3))}
		$RegCreateKeyTransactedA = {((f9 fa 63 54) | (54 63 fa f9))}
		$GetUserNameA = {((17 19 6f 9b) | (9b 6f 19 17))}
		$MapVirtualKeyA = {((15 97 50 0f) | (0f 50 97 15))}
		$WNetCloseEnum = {((18 da d3 5b) | (5b d3 da 18))}
		$InternetReadFileExA = {((6b d5 84 4d) | (4d 84 d5 6b))}
		$GetComputerNameA = {((30 01 1f 18) | (18 1f 01 30))}
		$RegFlushKey = {((5c c9 5d 70) | (70 5d c9 5c))}
		$VirtualAllocEx = {((2b 06 07 6d) | (6d 07 06 2b))}
		$GetSystemDefaultLangId = {((c5 dd 55 8f) | (8f 55 dd c5))}
		$SetFileTime = {((66 1c 6d 4f) | (4f 6d 1c 66))}
		$SendNotifyMessageA = {((2c 09 61 7b) | (7b 61 09 2c))}
		$LookupAccountNameA = {((14 45 56 05) | (05 56 45 14))}
		$NetShareEnum = {((12 16 72 be) | (be 72 16 12))}
		$IcmpSendEcho = {((15 25 7a 9c) | (9c 7a 25 15))}
		$DebugActiveProcessStop = {((0a a3 92 26) | (26 92 a3 0a))}
		$NtCreateFile = {((26 14 65 b7) | (b7 65 14 26))}
		$DecryptFileA = {((14 06 65 9b) | (9b 65 06 14))}
		$GetRawInputData = {((f0 2b 7a 55) | (55 7a 2b f0))}
		$BringWindowToTop = {((04 73 6f 4c) | (4c 6f 73 04))}
		$NetShareSetInfo = {((83 25 55 81) | (81 55 25 83))}
		$GetLogicalDrives = {((39 27 67 4a) | (4a 67 27 39))}
		$WriteFile = {((23 26 32 57) | (57 32 26 23))}
		$BitBlt = {((1d c5 4e 77) | (77 4e c5 1d))}
		$SendMessageTimeoutA = {((86 20 61 4d) | (4d 61 20 86))}
		$GetCurrentProcess = {((56 25 58 6f) | (6f 58 25 56))}
		$RegDeleteTreeA = {((21 ef 4a 48) | (48 4a ef 21))}
		$CreateProcessWithTokenW = {((b4 2a 9a 11) | (11 9a 2a b4))}
		$FindWindowA = {((65 24 79 58) | (58 79 24 65))}
		$CopyFileA = {((2f 1c 13 5a) | (5a 13 1c 2f))}
		$FtpPutFileA = {((4b 37 6f 57) | (57 6f 37 4b))}
		$NtOpenProcess = {((32 dd ab 70) | (70 ab dd 32))}
		$Send = {((1d 06 47 91) | (91 47 06 1d))}
		$EnumDeviceDrivers = {((db df 27 5c) | (5c 27 df db))}
		$Process32Next = {((3f c7 4a ba) | (ba 4a c7 3f))}
		$GetWindowDC = {((7a 15 51 4a) | (4a 51 15 7a))}
		$CryptDecrypt = {((21 3e 47 aa) | (aa 47 3e 21))}
		$ReadFile = {((1f 0c 58 13) | (13 58 0c 1f))}
		$VirtualProtect = {((19 2f 12 59) | (59 12 2f 19))}
		$OpenProcess = {((5e dc 65 6b) | (6b 65 dc 5e))}
		$WaitForMultipleObjectsEx = {((dc 27 82 42) | (42 82 27 dc))}
		$Inet_addr = {((03 1f 19 7f) | (7f 19 1f 03))}
		$WSAStartup = {((3a 0a 73 57) | (57 73 0a 3a))}
		$Bind = {((00 0a 47 80) | (80 47 0a 00))}
		$GetTempFileNameA = {((26 24 5a 3d) | (3d 5a 24 26))}
		$CreateMutexExA = {((13 e3 85 49) | (49 85 e3 13))}
		$DeviceIoControl = {((eb 1f 7c 68) | (68 7c 1f eb))}
		$CryptDestroyHash = {((25 0a 9d 31) | (31 9d 0a 25))}
		$CryptEncrypt = {((20 2a 7c aa) | (aa 7c 2a 20))}
		$NtSetContextThread = {((63 4b 98 4b) | (4b 98 4b 63))}
		$CryptReleaseContext = {((61 41 76 8c) | (8c 76 41 61))}
		$StretchBlt = {((15 4f 7d 53) | (53 7d 4f 15))}
		$NtWaitForSingleObject = {((c8 13 b5 3f) | (3f b5 13 c8))}
		$LoadLibraryExA = {((21 e1 61 79) | (79 61 e1 21))}
		$PeekMessageA = {((24 15 74 af) | (af 74 15 24))}
		$WNetAddConnectionA = {((2c 70 8c 65) | (65 8c 70 2c))}
		$NtCreateThread = {((3d 8f 72 4c) | (4c 72 8f 3d))}
		$ShellExecuteExA = {((ee 20 6f 7b) | (7b 6f 20 ee))}
		$GetMessageA = {((5e 13 70 69) | (69 70 13 5e))}
		$GetCurrentHwProfileA = {((08 d4 70 d9) | (d9 70 d4 08))}
		$PostThreadMessageA = {((33 78 10 0a) | (0a 10 78 33))}
		$RegOpenKeyExA = {((2c 36 dd 79) | (79 dd 36 2c))}
		$CreateWaitableTimer = {((58 51 63 88) | (88 63 51 58))}
		$NtSetInformationProcess = {((f5 47 b6 b6) | (b6 b6 47 f5))}
		$InternetSetOptionA = {((24 72 75 72) | (72 75 72 24))}
		$GetClipboardData = {((11 03 9f 16) | (16 9f 03 11))}
		$HttpSendRequestExA = {((de 69 89 47) | (47 89 69 de))}
		$CreateProcessA = {((14 9e 73 4d) | (4d 73 9e 14))}
		$CreateToolhelp32Snapshot = {((6c 96 92 b6) | (b6 92 96 6c))}
		$GetProcessHeap = {((05 d2 63 88) | (88 63 d2 05))}
		$MapVirtualKeyExA = {((12 58 7a dd) | (dd 7a 58 12))}
		$NtTerminateProcess = {((02 4e 04 84) | (84 04 4e 02))}
		$CallNextHookEx = {((1c e0 42 68) | (68 42 e0 1c))}
		$TerminateProcess = {((02 34 05 d8) | (d8 05 34 02))}
		$GetIpNetTable = {((12 38 84 70) | (70 84 38 12))}
		$SetThreadToken = {((14 f7 4a 85) | (85 4a f7 14))}
		$SetCurrentDirectory = {((76 ef 83 8f) | (8f 83 ef 76))}
		$GetFileTime = {((5a 10 6d 4f) | (4f 6d 10 5a))}
		$CreateRemoteThread = {((30 42 76 41) | (41 76 42 30))}
		$KeInsertQueueApc = {((2f 03 5b 22) | (22 5b 03 2f))}
		$SetWindowsHookExA = {((3f 31 5e 04) | (04 5e 31 3f))}
		$EnumWindows = {((4d 20 9f 70) | (70 9f 20 4d))}
		$NtSetSystemEnvironmentValueEx = {((62 ff d9 e1) | (e1 d9 ff 62))}
		$GetKeynameTextA = {((c9 df 9c 03) | (03 9c df c9))}
		$CryptCreateHash = {((df 2a 8d 72) | (72 8d 2a df))}
		$CreateThread = {((3c 01 5b 88) | (88 5b 01 3c))}
		$GetCurrentThread = {((16 55 02 22) | (22 02 55 16))}
		$EnumResourceTypesExA = {((50 c1 9d 83) | (83 9d c1 50))}
		$OpenSCManagerA = {((2f d9 9c 54) | (54 9c d9 2f))}
		$NtWriteVirtualMemory = {((e8 df 92 f0) | (f0 92 df e8))}
		$WSASocketA = {((12 73 68 59) | (59 68 73 12))}
		$SetWindowLongPtrA = {((27 34 4a 7a) | (7a 4a 34 27))}
		$CryptAcquireContextA = {((d2 31 20 a7) | (a7 20 31 d2))}
		$Thread32Next = {((29 c7 89 fe) | (fe 89 c7 29))}
		$RegisterRawInputDevices = {((f0 51 7f 12) | (12 7f 51 f0))}
		$Gethostbyname = {((34 34 a0 5c) | (5c a0 34 34))}
		$GetLogicalProcessorInformationEx = {((e1 26 31 84) | (84 31 26 e1))}
		$CreateWindowExA = {((e0 3a 54 70) | (70 54 3a e0))}
		$GetTickCount64 = {((08 b5 41 48) | (48 41 b5 08))}
		$SendMessageCallbackA = {((26 1c 61 b4) | (b4 61 1c 26))}
		$WNetAddConnection2A = {((76 9f 38 6e) | (6e 38 9f 76))}
		$ShellExecuteA = {((00 31 ac 77) | (77 ac 31 00))}
		$CryptGenRandom = {((00 c9 84 65) | (65 84 c9 00))}
		$RegConnectRegistryA = {((62 75 9e 1e) | (1e 9e 75 62))}
		$CryptBinaryToString = {((7a 60 8e 6a) | (6a 8e 60 7a))}
		$RtlMoveMemory = {((3c 04 be 58) | (58 be 04 3c))}
		$CopyFile2 = {((2f 1c 40 2b) | (2b 40 1c 2f))}
		$TimeGetTime = {((70 2a 62 48) | (48 62 2a 70))}
		$Thread32First = {((cf d4 e6 6c) | (6c e6 d4 cf))}
		$PostMessageA = {((26 31 43 b8) | (b8 43 31 26))}
		$WSACleanup = {((05 7c 77 60) | (60 77 7c 05))}
		$NtShutdownSystem = {((70 da 9d 1d) | (1d 9d da 70))}
		$GetModuleFileNameA = {((26 70 78 5b) | (5b 78 70 26))}
		$Socket = {((03 d6 78 66) | (66 78 d6 03))}
		$NtCreateUserProcess = {((8a 39 6b 15) | (15 6b 39 8a))}
		$GetCurrentProcessId = {((1e 2d af 6a) | (6a af 2d 1e))}
		$InternetCloseHandle = {((9e 16 83 57) | (57 83 16 9e))}
		$OpenFileMappingA = {((c4 1b 71 33) | (33 71 1b c4))}
		$NtQueryDirectoryFile = {((1f 2e 8c 54) | (54 8c 2e 1f))}
		$GetAdaptersInfo = {((eb 27 4e 1d) | (1d 4e 27 eb))}
		$MapViewOfFile = {((05 1d c3 53) | (53 c3 1d 05))}
		$TerminateThread = {((85 1e 78 75) | (75 78 1e 85))}
		$ControlServiceExA = {((32 5e 31 45) | (45 31 5e 32))}
		$CreateProcessInternal = {((2a cb e2 73) | (73 e2 cb 2a))}
		$CreateMutexA = {((3a 03 51 b4) | (b4 51 03 3a))}
		$WSAIoctl = {((1b 0c 5c 3d) | (3d 5c 0c 1b))}
		$RegOpenKeyTransactedA = {((65 3e c0 64) | (64 c0 3e 65))}
		$Connect = {((df 1f 5d 52) | (52 5d 1f df))}
		$RegQueryInfoKeyA = {((c9 3e 9c 59) | (59 9c 3e c9))}
		$RegSetKeySecurity = {((c5 34 25 28) | (28 25 34 c5))}
		$NtClose = {((de 37 62 52) | (52 62 37 de))}
		$Sleep = {((02 0d 85 69) | (69 85 0d 02))}
		$NtProtectVirtualMemory = {((1b 9f 25 b1) | (b1 25 9f 1b))}
		$NtReadVirtualMemory = {((57 d4 9c 21) | (21 9c d4 57))}
		$Gethostname = {((44 03 75 82) | (82 75 03 44))}
		$CopyFileExA = {((51 35 70 54) | (54 70 35 51))}
		$Wow64SetThreadContext = {((37 65 e0 00) | (00 e0 65 37))}
		$EnumProcessModulesEx = {((35 d5 19 a5) | (a5 19 d5 35))}
		$GetSystemDirectoryA = {((78 32 20 05) | (05 20 32 78))}
		$NtCreateProcess = {((f3 df 7a 80) | (80 7a df f3))}
		$SetThreadContext = {((29 3e 6b ec) | (ec 6b 3e 29))}
		$DnsQueryEx = {((05 51 4a 8e) | (8e 4a 51 05))}
		$LoadResource = {((3c 1c 53 8f) | (8f 53 1c 3c))}
		$NtAllocateVirtualMemory = {((e5 e8 ab 8f) | (8f ab e8 e5))}
		$ConnectNamedPipe = {((2c 3c 7f 3a) | (3a 7f 3c 2c))}
		$RegDeleteKeyValueA = {((d8 0a 76 5f) | (5f 76 0a d8))}
		$CreatePipe = {((15 44 78 57) | (57 78 44 15))}
		$NtDelayExecution = {((cc 15 86 d5) | (d5 86 15 cc))}
		$RtlGetVersion = {((cf 2c c1 76) | (76 c1 2c cf))}
		$NtOpenThread = {((2d ce 74 b3) | (b3 74 ce 2d))}
		$RegReplaceKeyA = {((22 f2 6f 6f) | (6f 6f f2 22))}
		$RtlCreateHeap = {((2a 06 82 7c) | (7c 82 06 2a))}
		$CheckRemoteDebuggerPresent = {((dd 68 6c 7d) | (7d 6c 68 dd))}
		$GetProcessIdOfThread = {((51 5a 5f 8b) | (8b 5f 5a 51))}
		$SetForegroundWindow = {((67 e3 97 91) | (91 97 e3 67))}
		$SetWinEventHook = {((80 25 8d 80) | (80 8d 25 80))}
		$RegisterHotKey = {((16 d4 1a 89) | (89 1a d4 16))}
		$NtQueryInformationProcess = {((04 d5 71 15) | (15 71 d5 04))}
		$CreateRemoteThreadEx = {((30 0f 95 a1) | (a1 95 0f 30))}
		$OpenClipboard = {((3d 19 b7 85) | (85 b7 19 3d))}
		$RegEnumValueA = {((38 27 bf 78) | (78 bf 27 38))}
		$URLDownloadToCacheFile = {((17 a3 72 78) | (78 72 a3 17))}
		$LocalAlloc = {((08 4f 53 42) | (42 53 4f 08))}
		$ShowWindow = {((28 03 90 73) | (73 90 03 28))}
		$VirtualQueryEx = {((04 11 01 59) | (59 01 11 04))}
		$NtQueueApcThread = {((25 37 5e 37) | (37 5e 37 25))}
		$NtMakeTemporaryObject = {((c5 5b be 7e) | (7e be 5b c5))}
		$VirtualAllocExNuma = {((30 20 9b 60) | (60 9b 20 30))}
		$RegOpenKeyA = {((72 33 6e 59) | (59 6e 33 72))}
		$EnumDesktopWindows = {((2e 8e 72 b1) | (b1 72 8e 2e))}
		$WaitForSingleObject = {((14 13 7c 92) | (92 7c 13 14))}
		$FindResourceExA = {((f9 25 86 52) | (52 86 25 f9))}
		$CryptStringToBinary = {((72 5c 6e 5a) | (5a 6e 5c 72))}
		$RegEnumKeyA = {((6a 21 7f 40) | (40 7f 21 6a))}
		$Select = {((02 d6 40 5b) | (5b 40 d6 02))}
		$WNetEnumResourceA = {((1c 3a 3e 69) | (69 3e 3a 1c))}
		$EnumProcesses = {((2d 30 9b 76) | (76 9b 30 2d))}
		$Listen = {((0c e8 49 6e) | (6e 49 e8 0c))}
		$RegCreateKeyA = {((1f 03 bb 7d) | (7d bb 03 1f))}
		$IsDebuggerPresent = {((ce 37 22 80) | (80 22 37 ce))}
		$FindNextUrlCacheEntryA = {((fb f2 93 67) | (67 93 f2 fb))}
		$StartServiceA = {((3e 06 56 5e) | (5e 56 06 3e))}
		$GetThreadContext = {((3d 3e 6a 18) | (18 6a 3e 3d))}
		$VirtualAlloc = {((c6 1e 6d 49) | (49 6d 1e c6))}
		$Module32First = {((d5 d7 80 6a) | (6a 80 d7 d5))}
		$FindFirstUrlCacheEntryA = {((f4 29 50 1b) | (1b 50 29 f4))}
		$SleepEx = {((c3 27 5b 5e) | (5e 5b 27 c3))}
		$MoveFileA = {((25 16 15 44) | (44 15 16 25))}
		$NtSetValueKey = {((21 2f 9e 27) | (27 9e 2f 21))}
		$SetWindowLongA = {((1d f9 67 6f) | (6f 67 f9 1d))}
		$MapViewOfFileEx = {((85 1d 46 6e) | (6e 46 1d 85))}
		$NtDuplicateObject = {((38 1b de 95) | (95 de 1b 38))}
		$GetKeyboardState = {((2b 26 7f 35) | (35 7f 26 2b))}
		$GetSystemTime = {((c6 28 9a 40) | (40 9a 28 c6))}
		$FindWindowExA = {((3b 37 ca 6c) | (6c ca 37 3b))}
		$RegQueryMultipleValuesA = {((c8 46 86 6d) | (6d 86 46 c8))}
		$DrawTextExA = {((6d 21 54 7a) | (7a 54 21 6d))}
		$RegEnumKeyExA = {((3d 1f b5 6b) | (6b b5 1f 3d))}
		$QueueUserAPC = {((24 2a 79 bb) | (bb 79 2a 24))}
		$RegSaveKeyA = {((61 07 7a 52) | (52 7a 07 61))}
		$CreateFileMappingA = {((13 5e 7c 6a) | (6a 7c 5e 13))}
		$CryptDestroyKey = {((e7 3a 4c 8b) | (8b 4c 3a e7))}
		$RegDeleteKeyExA = {((f5 36 67 7a) | (7a 67 36 f5))}
		$EnumResourceTypesA = {((32 49 12 96) | (96 12 49 32))}
		$RegSetKeyValueA = {((96 c4 7b 57) | (57 7b c4 96))}
		$timeSetEvent = {((c5 21 71 ab) | (ab 71 21 c5))}
		$RegSaveKeyExA = {((38 0d ce 4d) | (4d ce 0d 38))}
		$CountClipboardFormats = {((38 55 bd a1) | (a1 bd 55 38))}
		$HttpAddRequestHeaders = {((1a 21 a8 80) | (80 a8 21 1a))}
		$NtQueueApcThreadEx2 = {((7f 26 cd 23) | (23 cd 26 7f))}
		$RegCopyTreeA = {((c6 18 43 bb) | (bb 43 18 c6))}
		$ImpersonateLoggedOnUser = {((96 3e 32 94) | (94 32 3e 96))}
		$GetDriveTypeA = {((3e 3c 83 6f) | (6f 83 3c 3e))}
		$GetVersionExA = {((30 37 ca 6d) | (6d ca 37 30))}
		$InternetReadFile = {((30 3d 47 23) | (23 47 3d 30))}
		$RegOpenCurrentUser = {((d9 73 73 5c) | (5c 73 73 d9))}
		$GetThreadLocale = {((d9 10 81 5a) | (5a 81 10 d9))}
		$NtUnmapViewOfSection = {((35 22 af be) | (be af 22 35))}
		$FindNextFileA = {((1a cb af 5e) | (5e af cb 1a))}
		$GetLogicalProcessorInformation = {((d4 27 a7 69) | (69 a7 27 d4))}
		$FlushEfsCache = {((11 26 a7 66) | (66 a7 26 11))}
		$Closesocket = {((56 1a 47 7b) | (7b 47 1a 56))}
		$NetShareGetInfo = {((f7 21 55 81) | (81 55 21 f7))}
		$GetModuleHandleA = {((11 1d 62 33) | (33 62 1d 11))}
		$VirtualAlloc2FromApp = {((ac 11 93 37) | (37 93 11 ac))}
		$MoveFileExA = {((57 13 8a 5a) | (5a 8a 13 57))}
		$NtWaitForMultipleObjects = {((56 0d 97 34) | (34 97 0d 56))}
		$DeleteFileA = {((61 14 41 4e) | (4e 41 14 61))}
		$StartServiceCtrlDispatcherA = {((36 11 d6 86) | (86 d6 11 36))}
		$HttpOpenRequestA = {((55 07 6c cd) | (cd 6c 07 55))}
		$GetThreadInformation = {((c8 c5 70 9a) | (9a 70 c5 c8))}
		$NtDeleteKey = {((64 26 52 6c) | (6c 52 26 64))}
		$InternetWriteFile = {((3e 23 5d 0a) | (0a 5d 23 3e))}
		$LoadLibraryA = {((1e 33 63 b6) | (b6 63 33 1e))}
		$RegQueryValueExA = {((cd 0a 8f 6a) | (6a 8f 0a cd))}
		$NtCreateProcessEx = {((3c c9 2b 2c) | (2c 2b c9 3c))}
		$GetForegroundWindow = {((74 0f 97 91) | (91 97 0f 74))}
		$NtQuerySystemEnvironmentValueEx = {((91 ec 06 d1) | (d1 06 ec 91))}
		$SizeOfResource = {((d3 ee 18 52) | (52 18 ee d3))}
		$RegGetValueA = {((0a 1d 51 94) | (94 51 1d 0a))}
		$LdrLoadDll = {((2c 5a 63 59) | (59 63 5a 2c))}
		$NtResumeThread = {((3a d5 0c 56) | (56 0c d5 3a))}
		$MapViewOfFile3 = {((1b 83 0b 27) | (27 0b 83 1b))}
		$NtQueryTimer = {((10 13 50 c3) | (c3 50 13 10))}
		$RtlCopyMemory = {((3a 2a a0 66) | (66 a0 2a 3a))}
		$InternetConnectA = {((12 2c 7f c3) | (c3 7f 2c 12))}
		$SetClipboardData = {((35 03 9f 12) | (12 9f 03 35))}
		$GetKeyState = {((61 06 85 6a) | (6a 85 06 61))}
		$WriteProcessMemory = {((30 b4 66 9e) | (9e 66 b4 30))}
		$RtlSetProcessIsCritical = {((96 da 89 4f) | (4f 89 da 96))}
		$NetShareAdd = {((64 1a 4d 67) | (67 4d 1a 64))}
		$NtResumeProcess = {((d5 41 64 83) | (83 64 41 d5))}
		$GetProcessHeaps = {((d4 23 90 67) | (67 90 23 d4))}
		$RegDeleteKeyTransactedA = {((8c 3e 66 65) | (65 66 3e 8c))}
		$ReadProcessMemory = {((c8 25 3a 7a) | (7a 3a 25 c8))}
		$GetNativeSystemInfo = {((9a 3f 6f a9) | (a9 6f 3f 9a))}
		$ioctlsocket = {((54 04 4c 7c) | (7c 4c 04 54))}
		$CreateProcessAsUserA = {((df 02 75 fa) | (fa 75 02 df))}
		$PeekNamedPipe = {((1e 35 a6 7d) | (7d a6 35 1e))}
		$SuspendThread = {((2c 15 ba 65) | (65 ba 15 2c))}
		$CallWindowProcA = {((e1 19 8e 4c) | (4c 8e 19 e1))}
		$OpenServiceA = {((c8 03 5d a8) | (a8 5d 03 c8))}
		$SetTimer = {((19 16 55 46) | (46 55 16 19))}
		$MapViewOfFile2 = {((1b 83 0a 26) | (26 0a 83 1b))}
		$RegRestoreKeyA = {((3c f3 71 48) | (48 71 f3 3c))}
		$InternetOpenUrlA = {((d2 cb 5e df) | (df 5e cb d2))}
		$GetTempPathA = {((14 27 45 b6) | (b6 45 27 14))}
		$NtAdjustPrivilegesToken = {((b4 5b 0c 61) | (61 0c 5b b4))}
		$GetTickCount = {((09 37 4e a8) | (a8 4e 37 09))}
		$RegSetValueExA = {((3f e7 55 57) | (57 55 e7 3f))}
		$NtCreateSection = {((8f 3f 62 78) | (78 62 3f 8f))}
		$SetPropA = {((2c 3d 5b 34) | (34 5b 3d 2c))}
		$GetModuleFileNameExA = {((3a 34 89 b8) | (b8 89 34 3a))}
		$PathFileExistsA = {((e6 d1 7a 63) | (63 7a d1 e6))}
		$SetFocus = {((2d 0c 78 2f) | (2f 78 0c 2d))}
		$GetDCEx = {((c3 0d 43 6e) | (6e 43 0d c3))}
		$WNetOpenEnumA = {((32 2e c8 72) | (72 c8 2e 32))}
		$FindFirstFileA = {((1e df 77 44) | (44 77 df 1e))}
		$AttachThreadInput = {((35 2e 32 94) | (94 32 2e 35))}
		$AdjustTokenPrivileges = {((22 88 51 89) | (89 51 88 22))}
		$EnumProcessModules = {((cc 46 73 94) | (94 73 46 cc))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

cf964817-e362-4115-aa17-16954017d640
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
