api_hashes_poisonIvyHash

YARA detection rule by filescanio
Rule api_hashes_poisonIvyHash (No description metadata provided).
import "math"
import "pe"
rule api_hashes_poisonIvyHash : hardened
{
	strings:
		$ControlService = {((1f da ff f6) | (f6 ff da 1f))}
		$HttpSendRequestA = {((86 23 b8 15) | (15 b8 23 86))}
		$SetThreadPriority = {((1e 53 3f 17) | (17 3f 53 1e))}
		$Recv = {((bb fd c7 8e) | (8e c7 fd bb))}
		$QueryPerformanceFrequency = {((d9 e6 e5 42) | (42 e5 e6 d9))}
		$RegDeleteValueA = {((8a 9a d2 24) | (24 d2 9a 8a))}
		$GetWindowsDirectoryA = {((fe 24 82 74) | (74 82 24 fe))}
		$CryptSetKeyParam = {((a7 ad 8a 5a) | (5a 8a ad a7))}
		$RegCreateKeyExA = {((2c 82 21 98) | (98 21 82 2c))}
		$Module32Next = {((57 91 4e 4d) | (4d 4e 91 57))}
		$RegOpenUserClassesRoot = {((5a 27 0a 88) | (88 0a 27 5a))}
		$NtReadVirtualMemoryEx = {((49 44 07 cd) | (cd 07 44 49))}
		$InternetOpenA = {((8a b0 b5 34) | (34 b5 b0 8a))}
		$URLOpenBlockingStream = {((52 d1 d6 8c) | (8c d6 d1 52))}
		$NtSetInformationThread = {((50 4c 74 6c) | (6c 74 4c 50))}
		$CreateFileA = {((8c 89 2d df) | (df 2d 89 8c))}
		$UnhookWindowsHookEx = {((f4 87 e1 23) | (23 e1 87 f4))}
		$GetCurrentThreadId = {((06 34 27 11) | (11 27 34 06))}
		$Accept = {((3c b8 02 49) | (49 02 b8 3c))}
		$HeapReAlloc = {((88 5f b9 3e) | (3e b9 5f 88))}
		$WinExec = {((28 45 2c 4f) | (4f 2c 45 28))}
		$NtQueueApcThreadEx = {((44 71 06 ab) | (ab 06 71 44))}
		$VirtualAllocFromApp = {((ce 39 57 dc) | (dc 57 39 ce))}
		$RegLoadKeyA = {((a7 7d 2c 64) | (64 2c 7d a7))}
		$OutputDebugStringA = {((74 95 b3 ad) | (ad b3 95 74))}
		$GetFileAttributesA = {((c6 33 d3 de) | (de d3 33 c6))}
		$SetWaitableTimer = {((fe e7 de e6) | (e6 de e7 fe))}
		$SendMessageA = {((93 56 06 8f) | (8f 06 56 93))}
		$RegUnLoadKeyA = {((80 5f d4 73) | (73 d4 5f 80))}
		$SetEnvironmentVariableA = {((ca 9b 01 0e) | (0e 01 9b ca))}
		$VirtualAlloc2 = {((d8 8e 94 72) | (72 94 8e d8))}
		$CryptProtectData = {((db 7e 0e cc) | (cc 0e 7e db))}
		$GetDesktopWindow = {((b8 f9 ed 7b) | (7b ed f9 b8))}
		$RegGetKeySecurity = {((a6 a9 52 52) | (52 52 a9 a6))}
		$GetDC = {((ba d7 6d 5b) | (5b 6d d7 ba))}
		$LookupPrivilegeValueA = {((71 64 68 46) | (46 68 64 71))}
		$CryptGetHashParam = {((e2 b1 06 f6) | (f6 06 b1 e2))}
		$HeapAlloc = {((6c 57 24 80) | (80 24 57 6c))}
		$RegCloseKey = {((84 18 02 af) | (af 02 18 84))}
		$CryptHashData = {((cf 73 1c 68) | (68 1c 73 cf))}
		$GlobalAlloc = {((83 a3 53 c3) | (c3 53 a3 83))}
		$RegOverridePredefKey = {((e7 f5 55 6c) | (6c 55 f5 e7))}
		$EnumSystemLocalesA = {((ae 3c bf 83) | (83 bf 3c ae))}
		$GetProcessId = {((04 4f 71 04) | (04 71 4f 04))}
		$RegLoadMUIStringA = {((46 f1 cd ae) | (ae cd f1 46))}
		$SearchPathA = {((f4 d9 d0 33) | (33 d0 d9 f4))}
		$FindClose = {((c2 00 be 21) | (21 be 00 c2))}
		$NtDeleteValueKey = {((6c 78 34 ac) | (ac 34 78 6c))}
		$URLDownloadToFile = {((1f eb 83 ec) | (ec 83 eb 1f))}
		$Toolhelp32ReadProcessMemory = {((c4 ee d7 59) | (59 d7 ee c4))}
		$GetProcAddress = {((ff c9 7c 1f) | (1f 7c c9 ff))}
		$OpenProcessToken = {((bf 26 cd 60) | (60 cd 26 bf))}
		$HeapCreate = {((7d b9 76 1e) | (1e 76 b9 7d))}
		$UuidFromStringA = {((1d 34 a0 b7) | (b7 a0 34 1d))}
		$VirtualProtectEx = {((56 e1 b6 57) | (57 b6 e1 56))}
		$GetSystemTimeAsFileTime = {((b2 3c 8d 35) | (35 8d 3c b2))}
		$GetModuleBaseNameA = {((13 74 d2 77) | (77 d2 74 13))}
		$lstrcatA = {((c7 de 8b ac) | (ac 8b de c7))}
		$SetFileAttributesA = {((3c 19 e5 36) | (36 e5 19 3c))}
		$FindResourceA = {((62 ec 77 c4) | (c4 77 ec 62))}
		$WaitForMultipleObjects = {((4e b2 66 70) | (70 66 b2 4e))}
		$QueryPerformanceCounter = {((4a 7d 99 81) | (81 99 7d 4a))}
		$NtCreateThreadEx = {((59 9c 24 21) | (21 24 9c 59))}
		$NtContinue = {((b0 9e f3 08) | (08 f3 9e b0))}
		$IsWoW64Process = {((c3 62 e9 e6) | (e6 e9 62 c3))}
		$DnsQuery_A = {((6f 54 c9 1f) | (1f c9 54 6f))}
		$VirtualProtectFromApp = {((da 50 cd e5) | (e5 cd 50 da))}
		$GetAsyncKeyState = {((d2 86 ed 1a) | (1a ed 86 d2))}
		$EncryptFileA = {((26 e5 ad ef) | (ef ad e5 26))}
		$DuplicateToken = {((10 c9 76 40) | (40 76 c9 10))}
		$CryptDeriveKey = {((51 27 4d a1) | (a1 4d 27 51))}
		$LockResource = {((d0 26 cf 30) | (30 cf 26 d0))}
		$ResumeThread = {((60 87 96 1b) | (1b 96 87 60))}
		$WaitForSingleObjectEx = {((7a 26 84 b9) | (b9 84 26 7a))}
		$NtSuspendProcess = {((b4 18 f6 56) | (56 f6 18 b4))}
		$NetShareCheck = {((d0 68 13 f3) | (f3 13 68 d0))}
		$OpenThread = {((ff b8 54 86) | (86 54 b8 ff))}
		$URLOpenStream = {((da e2 06 31) | (31 06 e2 da))}
		$UnmapViewOfFile = {((94 52 4b 42) | (42 4b 52 94))}
		$CreateFile2 = {((88 9b 07 ea) | (ea 07 9b 88))}
		$DeleteService = {((59 95 ee 4a) | (4a ee 95 59))}
		$GetThreadId = {((80 bd 55 52) | (52 55 bd 80))}
		$RegDeleteKeyA = {((fa 4c ca 28) | (28 ca 4c fa))}
		$CreateTimerQueueTimer = {((b9 2d cf 97) | (97 cf 2d b9))}
		$SetProcessDEPPolicy = {((13 12 12 17) | (17 12 12 13))}
		$CreateServiceA = {((b1 dd 04 88) | (88 04 dd b1))}
		$ExitWindowsEx = {((44 ab 7a 1c) | (1c 7a ab 44))}
		$NtMapViewOfSection = {((10 71 06 14) | (14 06 71 10))}
		$NtTerminateThread = {((b4 63 b5 0d) | (0d b5 63 b4))}
		$Process32First = {((74 98 c4 1b) | (1b c4 98 74))}
		$RegCreateKeyTransactedA = {((2e 42 65 72) | (72 65 42 2e))}
		$GetUserNameA = {((bb 5d 5b 69) | (69 5b 5d bb))}
		$MapVirtualKeyA = {((ca f2 dc 16) | (16 dc f2 ca))}
		$WNetCloseEnum = {((a0 37 7f eb) | (eb 7f 37 a0))}
		$InternetReadFileExA = {((f3 48 c5 5f) | (5f c5 48 f3))}
		$GetComputerNameA = {((86 66 3b 60) | (60 3b 66 86))}
		$RegFlushKey = {((f5 b1 40 d1) | (d1 40 b1 f5))}
		$VirtualAllocEx = {((da 89 fc 22) | (22 fc 89 da))}
		$GetSystemDefaultLangId = {((06 24 cf a3) | (a3 cf 24 06))}
		$SetFileTime = {((4b 2a 3e 7d) | (7d 3e 2a 4b))}
		$SendNotifyMessageA = {((39 e3 ac 20) | (20 ac e3 39))}
		$LookupAccountNameA = {((21 79 b8 12) | (12 b8 79 21))}
		$NetShareEnum = {((f5 81 e8 91) | (91 e8 81 f5))}
		$IcmpSendEcho = {((81 b0 f6 22) | (22 f6 b0 81))}
		$DebugActiveProcessStop = {((97 e3 e0 1f) | (1f e0 e3 97))}
		$NtCreateFile = {((50 34 fd 80) | (80 fd 34 50))}
		$DecryptFileA = {((8a e1 d0 64) | (64 d0 e1 8a))}
		$GetRawInputData = {((c5 34 c4 d3) | (d3 c4 34 c5))}
		$BringWindowToTop = {((31 a0 a2 53) | (53 a2 a0 31))}
		$NetShareSetInfo = {((3d 80 b7 8f) | (8f b7 80 3d))}
		$GetLogicalDrives = {((de c5 e8 93) | (93 e8 c5 de))}
		$WriteFile = {((21 77 77 93) | (93 77 77 21))}
		$BitBlt = {((56 d2 bd b3) | (b3 bd d2 56))}
		$SendMessageTimeoutA = {((4b 7f d3 c1) | (c1 d3 7f 4b))}
		$GetCurrentProcess = {((03 69 0e 66) | (66 0e 69 03))}
		$RegDeleteTreeA = {((0b e4 88 3e) | (3e 88 e4 0b))}
		$CreateProcessWithTokenW = {((22 37 14 f0) | (f0 14 37 22))}
		$FindWindowA = {((85 ab 33 23) | (23 33 ab 85))}
		$CopyFileA = {((5b d0 5d b1) | (b1 5d d0 5b))}
		$FtpPutFileA = {((09 51 99 55) | (55 99 51 09))}
		$NtOpenProcess = {((69 d2 5b 0f) | (0f 5b d2 69))}
		$Send = {((f6 b1 0d be) | (be 0d b1 f6))}
		$EnumDeviceDrivers = {((47 77 19 f6) | (f6 19 77 47))}
		$Process32Next = {((49 64 a3 e8) | (e8 a3 64 49))}
		$GetWindowDC = {((31 39 2b 30) | (30 2b 39 31))}
		$CryptDecrypt = {((69 95 85 01) | (01 85 95 69))}
		$ReadFile = {((54 d8 61 5a) | (5a 61 d8 54))}
		$VirtualProtect = {((79 c3 d4 bb) | (bb d4 c3 79))}
		$OpenProcess = {((33 d3 50 c4) | (c4 50 d3 33))}
		$WaitForMultipleObjectsEx = {((5b 80 5d 03) | (03 5d 80 5b))}
		$Inet_addr = {((2a b1 b8 ce) | (ce b8 b1 2a))}
		$WSAStartup = {((bb a4 d8 8f) | (8f d8 a4 bb))}
		$Bind = {((e1 e7 0c 34) | (34 0c e7 e1))}
		$GetTempFileNameA = {((dc 3b ee 9c) | (9c ee 3b dc))}
		$CreateMutexExA = {((83 d1 97 bc) | (bc 97 d1 83))}
		$DeviceIoControl = {((cc 09 d5 1e) | (1e d5 09 cc))}
		$CryptDestroyHash = {((72 02 69 34) | (34 69 02 72))}
		$CryptEncrypt = {((a7 38 d1 65) | (65 d1 38 a7))}
		$NtSetContextThread = {((2c 37 b1 c0) | (c0 b1 37 2c))}
		$CryptReleaseContext = {((ae 76 40 00) | (00 40 76 ae))}
		$StretchBlt = {((37 a1 c1 e7) | (e7 c1 a1 37))}
		$NtWaitForSingleObject = {((48 60 09 7d) | (7d 09 60 48))}
		$LoadLibraryExA = {((97 46 a3 d6) | (d6 a3 46 97))}
		$PeekMessageA = {((fc b6 b6 88) | (88 b6 b6 fc))}
		$WNetAddConnectionA = {((f8 0f 17 e0) | (e0 17 0f f8))}
		$NtCreateThread = {((15 1f 2c 34) | (34 2c 1f 15))}
		$ShellExecuteExA = {((5b 98 a9 78) | (78 a9 98 5b))}
		$GetMessageA = {((a3 32 9e 16) | (16 9e 32 a3))}
		$GetCurrentHwProfileA = {((a1 c6 36 fc) | (fc 36 c6 a1))}
		$PostThreadMessageA = {((73 dc 2e e9) | (e9 2e dc 73))}
		$RegOpenKeyExA = {((cd 19 56 99) | (99 56 19 cd))}
		$CreateWaitableTimer = {((f5 df 87 92) | (92 87 df f5))}
		$NtSetInformationProcess = {((73 a3 af 82) | (82 af a3 73))}
		$InternetSetOptionA = {((95 fa 7a 4e) | (4e 7a fa 95))}
		$GetClipboardData = {((3a a7 f0 6f) | (6f f0 a7 3a))}
		$HttpSendRequestExA = {((8f 34 99 8d) | (8d 99 34 8f))}
		$CreateProcessA = {((26 7e 0b 05) | (05 0b 7e 26))}
		$CreateToolhelp32Snapshot = {((6b a5 c8 3c) | (3c c8 a5 6b))}
		$GetProcessHeap = {((e1 41 04 2a) | (2a 04 41 e1))}
		$MapVirtualKeyExA = {((ee c6 23 de) | (de 23 c6 ee))}
		$NtTerminateProcess = {((49 f2 d1 8d) | (8d d1 f2 49))}
		$CallNextHookEx = {((9c b3 97 30) | (30 97 b3 9c))}
		$TerminateProcess = {((41 a0 50 af) | (af 50 a0 41))}
		$GetIpNetTable = {((f7 4a 51 82) | (82 51 4a f7))}
		$SetThreadToken = {((bd a6 a0 f4) | (f4 a0 a6 bd))}
		$SetCurrentDirectory = {((68 6d f5 99) | (99 f5 6d 68))}
		$GetFileTime = {((44 34 e8 fe) | (fe e8 34 44))}
		$CreateRemoteThread = {((cf 4a 7f 65) | (65 7f 4a cf))}
		$KeInsertQueueApc = {((1c 74 01 5b) | (5b 01 74 1c))}
		$SetWindowsHookExA = {((ec e6 92 b8) | (b8 92 e6 ec))}
		$EnumWindows = {((45 93 6c 65) | (65 6c 93 45))}
		$NtSetSystemEnvironmentValueEx = {((56 cc 34 bb) | (bb 34 cc 56))}
		$GetKeynameTextA = {((16 16 28 e1) | (e1 28 16 16))}
		$CryptCreateHash = {((7b 61 78 76) | (76 78 61 7b))}
		$CreateThread = {((19 f3 36 07) | (07 36 f3 19))}
		$GetCurrentThread = {((f0 19 1f 69) | (69 1f 19 f0))}
		$EnumResourceTypesExA = {((54 df 66 89) | (89 66 df 54))}
		$OpenSCManagerA = {((57 e1 18 bb) | (bb 18 e1 57))}
		$NtWriteVirtualMemory = {((8d e3 e0 1c) | (1c e0 e3 8d))}
		$WSASocketA = {((d1 7f 19 3c) | (3c 19 7f d1))}
		$SetWindowLongPtrA = {((37 08 ec a8) | (a8 ec 08 37))}
		$CryptAcquireContextA = {((74 16 fa c4) | (c4 fa 16 74))}
		$Thread32Next = {((4c 93 63 59) | (59 63 93 4c))}
		$RegisterRawInputDevices = {((de 45 12 64) | (64 12 45 de))}
		$Gethostbyname = {((27 89 20 d4) | (d4 20 89 27))}
		$GetLogicalProcessorInformationEx = {((81 6e e0 07) | (07 e0 6e 81))}
		$CreateWindowExA = {((24 89 1e 4c) | (4c 1e 89 24))}
		$GetTickCount64 = {((dc 88 18 50) | (50 18 88 dc))}
		$SendMessageCallbackA = {((21 3a ef 74) | (74 ef 3a 21))}
		$WNetAddConnection2A = {((cd 25 aa af) | (af aa 25 cd))}
		$ShellExecuteA = {((31 8a 98 8b) | (8b 98 8a 31))}
		$CryptGenRandom = {((89 0b cd b7) | (b7 cd 0b 89))}
		$RegConnectRegistryA = {((8d d4 d8 50) | (50 d8 d4 8d))}
		$CryptBinaryToString = {((65 42 6b 4e) | (4e 6b 42 65))}
		$RtlMoveMemory = {((b0 c3 fe 81) | (81 fe c3 b0))}
		$CopyFile2 = {((5f c2 77 84) | (84 77 c2 5f))}
		$TimeGetTime = {((e4 81 b5 f8) | (f8 b5 81 e4))}
		$Thread32First = {((c8 fb b0 c1) | (c1 b0 fb c8))}
		$PostMessageA = {((86 67 8a 04) | (04 8a 67 86))}
		$WSACleanup = {((10 5b 23 b2) | (b2 23 5b 10))}
		$NtShutdownSystem = {((15 1f 41 0d) | (0d 41 1f 15))}
		$GetModuleFileNameA = {((04 dc f3 92) | (92 f3 dc 04))}
		$Socket = {((41 09 59 7d) | (7d 59 09 41))}
		$NtCreateUserProcess = {((77 0d f0 45) | (45 f0 0d 77))}
		$GetCurrentProcessId = {((eb 1c e8 5c) | (5c e8 1c eb))}
		$InternetCloseHandle = {((ee e4 12 41) | (41 12 e4 ee))}
		$OpenFileMappingA = {((41 d6 49 12) | (12 49 d6 41))}
		$NtQueryDirectoryFile = {((d5 49 41 78) | (78 41 49 d5))}
		$GetAdaptersInfo = {((72 3a a9 4c) | (4c a9 3a 72))}
		$MapViewOfFile = {((79 7b 49 ec) | (ec 49 7b 79))}
		$TerminateThread = {((8b df ba 40) | (40 ba df 8b))}
		$ControlServiceExA = {((a4 60 ff 74) | (74 ff 60 a4))}
		$CreateProcessInternal = {((80 39 62 35) | (35 62 39 80))}
		$CreateMutexA = {((20 b9 43 e7) | (e7 43 b9 20))}
		$WSAIoctl = {((49 f9 b5 0b) | (0b b5 f9 49))}
		$RegOpenKeyTransactedA = {((a9 32 83 a6) | (a6 83 32 a9))}
		$Connect = {((a6 08 4f d7) | (d7 4f 08 a6))}
		$RegQueryInfoKeyA = {((fb d2 bc e8) | (e8 bc d2 fb))}
		$RegSetKeySecurity = {((68 b7 a8 7e) | (7e a8 b7 68))}
		$NtClose = {((b9 64 b7 be) | (be b7 64 b9))}
		$Sleep = {((0a c1 36 ba) | (ba 36 c1 0a))}
		$NtProtectVirtualMemory = {((bc 35 c4 70) | (70 c4 35 bc))}
		$NtReadVirtualMemory = {((21 3a bc f7) | (f7 bc 3a 21))}
		$Gethostname = {((bf 51 0d 99) | (99 0d 51 bf))}
		$CopyFileExA = {((95 3f 2b 64) | (64 2b 3f 95))}
		$Wow64SetThreadContext = {((ec 17 45 b4) | (b4 45 17 ec))}
		$EnumProcessModulesEx = {((4b bb c0 c5) | (c5 c0 bb 4b))}
		$GetSystemDirectoryA = {((59 3a e7 ce) | (ce e7 3a 59))}
		$NtCreateProcess = {((16 56 25 1c) | (1c 25 56 16))}
		$SetThreadContext = {((5a 5c 3d a0) | (a0 3d 5c 5a))}
		$DnsQueryEx = {((70 61 62 03) | (03 62 61 70))}
		$LoadResource = {((79 41 2d 7c) | (7c 2d 41 79))}
		$NtAllocateVirtualMemory = {((e5 3a a2 52) | (52 a2 3a e5))}
		$ConnectNamedPipe = {((62 50 ed eb) | (eb ed 50 62))}
		$RegDeleteKeyValueA = {((7f 3c 23 fb) | (fb 23 3c 7f))}
		$CreatePipe = {((ae 7c 15 48) | (48 15 7c ae))}
		$NtDelayExecution = {((8c 29 be e1) | (e1 be 29 8c))}
		$RtlGetVersion = {((69 bd cd 86) | (86 cd bd 69))}
		$NtOpenThread = {((fb 6c 84 78) | (78 84 6c fb))}
		$RegReplaceKeyA = {((58 50 49 81) | (81 49 50 58))}
		$RtlCreateHeap = {((b5 27 a9 60) | (60 a9 27 b5))}
		$CheckRemoteDebuggerPresent = {((a6 4f 22 cd) | (cd 22 4f a6))}
		$GetProcessIdOfThread = {((43 05 8a 26) | (26 8a 05 43))}
		$SetForegroundWindow = {((d9 7e 63 43) | (43 63 7e d9))}
		$SetWinEventHook = {((aa af 40 dc) | (dc 40 af aa))}
		$RegisterHotKey = {((21 ca aa 5f) | (5f aa ca 21))}
		$NtQueryInformationProcess = {((b9 cc 7a 35) | (35 7a cc b9))}
		$CreateRemoteThreadEx = {((08 5e 92 2f) | (2f 92 5e 08))}
		$OpenClipboard = {((a9 07 89 fc) | (fc 89 07 a9))}
		$RegEnumValueA = {((e5 d3 95 bc) | (bc 95 d3 e5))}
		$URLDownloadToCacheFile = {((c9 e2 c9 d6) | (d6 c9 e2 c9))}
		$LocalAlloc = {((46 ed e1 ab) | (ab e1 ed 46))}
		$ShowWindow = {((15 9e db 4e) | (4e db 9e 15))}
		$VirtualQueryEx = {((d4 af a1 14) | (14 a1 af d4))}
		$NtQueueApcThread = {((22 2e 27 ca) | (ca 27 2e 22))}
		$NtMakeTemporaryObject = {((5b 53 cc bd) | (bd cc 53 5b))}
		$VirtualAllocExNuma = {((9c 2d 9e c6) | (c6 9e 2d 9c))}
		$RegOpenKeyA = {((6e bf 34 53) | (53 34 bf 6e))}
		$EnumDesktopWindows = {((56 a6 fa b1) | (b1 fa a6 56))}
		$WaitForSingleObject = {((d4 54 02 29) | (29 02 54 d4))}
		$FindResourceExA = {((1c cc 56 3d) | (3d 56 cc 1c))}
		$CryptStringToBinary = {((23 91 5c ce) | (ce 5c 91 23))}
		$RegEnumKeyA = {((73 ea 73 b4) | (b4 73 ea 73))}
		$Select = {((86 90 e6 4b) | (4b e6 90 86))}
		$WNetEnumResourceA = {((75 c3 c1 9a) | (9a c1 c3 75))}
		$EnumProcesses = {((c6 06 ba 60) | (60 ba 06 c6))}
		$Listen = {((de 71 7c d7) | (d7 7c 71 de))}
		$RegCreateKeyA = {((3e ec fd 9b) | (9b fd ec 3e))}
		$IsDebuggerPresent = {((52 e3 be b1) | (b1 be e3 52))}
		$FindNextUrlCacheEntryA = {((1e d8 89 06) | (06 89 d8 1e))}
		$StartServiceA = {((75 10 a9 c8) | (c8 a9 10 75))}
		$GetThreadContext = {((3e 05 83 12) | (12 83 05 3e))}
		$VirtualAlloc = {((44 02 89 0e) | (0e 89 02 44))}
		$Module32First = {((d2 3a 66 91) | (91 66 3a d2))}
		$FindFirstUrlCacheEntryA = {((4f dd b7 62) | (62 b7 dd 4f))}
		$SleepEx = {((01 fe 77 40) | (40 77 fe 01))}
		$MoveFileA = {((23 08 92 3f) | (3f 92 08 23))}
		$NtSetValueKey = {((13 c6 94 8f) | (8f 94 c6 13))}
		$SetWindowLongA = {((ab 20 d0 47) | (47 d0 20 ab))}
		$MapViewOfFileEx = {((2d a5 92 85) | (85 92 a5 2d))}
		$NtDuplicateObject = {((3c de b5 dd) | (dd b5 de 3c))}
		$GetKeyboardState = {((63 dd f1 ce) | (ce f1 dd 63))}
		$GetSystemTime = {((75 b7 eb e8) | (e8 eb b7 75))}
		$FindWindowExA = {((7c 42 51 d8) | (d8 51 42 7c))}
		$RegQueryMultipleValuesA = {((db b7 e9 54) | (54 e9 b7 db))}
		$DrawTextExA = {((b8 92 d8 fe) | (fe d8 92 b8))}
		$RegEnumKeyExA = {((34 9e fa d4) | (d4 fa 9e 34))}
		$QueueUserAPC = {((cf bb f9 a3) | (a3 f9 bb cf))}
		$RegSaveKeyA = {((a8 ab c2 13) | (13 c2 ab a8))}
		$CreateFileMappingA = {((96 b2 d9 6c) | (6c d9 b2 96))}
		$CryptDestroyKey = {((a6 5e c7 32) | (32 c7 5e a6))}
		$RegDeleteKeyExA = {((5b d7 bd 4c) | (4c bd d7 5b))}
		$EnumResourceTypesA = {((b5 80 ae 65) | (65 ae 80 b5))}
		$RegSetKeyValueA = {((96 e0 16 1d) | (1d 16 e0 96))}
		$timeSetEvent = {((8b 5a e6 0f) | (0f e6 5a 8b))}
		$RegSaveKeyExA = {((69 be 88 a1) | (a1 88 be 69))}
		$CountClipboardFormats = {((d4 f2 df 43) | (43 df f2 d4))}
		$HttpAddRequestHeaders = {((17 98 fb 26) | (26 fb 98 17))}
		$NtQueueApcThreadEx2 = {((7e 32 b0 9a) | (9a b0 32 7e))}
		$RegCopyTreeA = {((33 c0 23 55) | (55 23 c0 33))}
		$ImpersonateLoggedOnUser = {((8e 97 f0 67) | (67 f0 97 8e))}
		$GetDriveTypeA = {((b9 9f 1b 1e) | (1e 1b 9f b9))}
		$GetVersionExA = {((44 d4 c0 75) | (75 c0 d4 44))}
		$InternetReadFile = {((1f b9 29 86) | (86 29 b9 1f))}
		$RegOpenCurrentUser = {((17 2f 48 09) | (09 48 2f 17))}
		$GetThreadLocale = {((aa 54 48 82) | (82 48 54 aa))}
		$NtUnmapViewOfSection = {((86 4c f0 9b) | (9b f0 4c 86))}
		$FindNextFileA = {((aa 70 01 06) | (06 01 70 aa))}
		$GetLogicalProcessorInformation = {((f5 89 f4 ed) | (ed f4 89 f5))}
		$FlushEfsCache = {((e0 d2 7e dd) | (dd 7e d2 e0))}
		$Closesocket = {((04 f7 16 3d) | (3d 16 f7 04))}
		$NetShareGetInfo = {((c5 71 88 5e) | (5e 88 71 c5))}
		$GetModuleHandleA = {((82 b6 18 d4) | (d4 18 b6 82))}
		$VirtualAlloc2FromApp = {((d9 39 ff 49) | (49 ff 39 d9))}
		$MoveFileExA = {((3b e4 39 58) | (58 39 e4 3b))}
		$NtWaitForMultipleObjects = {((e7 47 cd fe) | (fe cd 47 e7))}
		$DeleteFileA = {((de 25 6f de) | (de 6f 25 de))}
		$StartServiceCtrlDispatcherA = {((c7 86 8f 16) | (16 8f 86 c7))}
		$HttpOpenRequestA = {((08 26 2a 55) | (55 2a 26 08))}
		$GetThreadInformation = {((70 c0 8b 07) | (07 8b c0 70))}
		$NtDeleteKey = {((0e 86 95 d5) | (d5 95 86 0e))}
		$InternetWriteFile = {((ae 59 88 24) | (24 88 59 ae))}
		$LoadLibraryA = {((41 34 d1 ad) | (ad d1 34 41))}
		$RegQueryValueExA = {((88 b7 09 3b) | (3b 09 b7 88))}
		$NtCreateProcessEx = {((7d 1d 31 66) | (66 31 1d 7d))}
		$GetForegroundWindow = {((77 55 23 3f) | (3f 23 55 77))}
		$NtQuerySystemEnvironmentValueEx = {((ef 6b 13 9c) | (9c 13 6b ef))}
		$SizeOfResource = {((81 3d 38 44) | (44 38 3d 81))}
		$RegGetValueA = {((c9 c4 a6 5c) | (5c a6 c4 c9))}
		$LdrLoadDll = {((81 a9 4a c4) | (c4 4a a9 81))}
		$NtResumeThread = {((6c 6b 8c 28) | (28 8c 6b 6c))}
		$MapViewOfFile3 = {((8f ac 5f a7) | (a7 5f ac 8f))}
		$NtQueryTimer = {((de 16 88 68) | (68 88 16 de))}
		$RtlCopyMemory = {((ba bb 88 69) | (69 88 bb ba))}
		$InternetConnectA = {((68 10 96 2d) | (2d 96 10 68))}
		$SetClipboardData = {((5e fe 4e dd) | (dd 4e fe 5e))}
		$GetKeyState = {((12 93 d2 2b) | (2b d2 93 12))}
		$WriteProcessMemory = {((0e 9b ba d5) | (d5 ba 9b 0e))}
		$RtlSetProcessIsCritical = {((45 f6 cf 4f) | (4f cf f6 45))}
		$NetShareAdd = {((63 69 9a 05) | (05 9a 69 63))}
		$NtResumeProcess = {((02 2e 0d f3) | (f3 0d 2e 02))}
		$GetProcessHeaps = {((0d 4a 4d 6a) | (6a 4d 4a 0d))}
		$RegDeleteKeyTransactedA = {((93 cc a4 47) | (47 a4 cc 93))}
		$ReadProcessMemory = {((4a 27 08 9f) | (9f 08 27 4a))}
		$GetNativeSystemInfo = {((84 5a 4f 6a) | (6a 4f 5a 84))}
		$ioctlsocket = {((0e 01 d5 c9) | (c9 d5 01 0e))}
		$CreateProcessAsUserA = {((ac a1 e0 5a) | (5a e0 a1 ac))}
		$PeekNamedPipe = {((de 40 68 13) | (13 68 40 de))}
		$SuspendThread = {((83 61 99 1b) | (1b 99 61 83))}
		$CallWindowProcA = {((e0 5c 1e 20) | (20 1e 5c e0))}
		$OpenServiceA = {((30 f9 4b bd) | (bd 4b f9 30))}
		$SetTimer = {((b4 9e 51 46) | (46 51 9e b4))}
		$MapViewOfFile2 = {((96 b7 6e e6) | (e6 6e b7 96))}
		$RegRestoreKeyA = {((70 5c 97 a3) | (a3 97 5c 70))}
		$InternetOpenUrlA = {((72 09 68 f0) | (f0 68 09 72))}
		$GetTempPathA = {((d3 2a e9 9d) | (9d e9 2a d3))}
		$NtAdjustPrivilegesToken = {((69 ce 6b 02) | (02 6b ce 69))}
		$GetTickCount = {((61 3f d7 ba) | (ba d7 3f 61))}
		$RegSetValueExA = {((5b 9e c9 c6) | (c6 c9 9e 5b))}
		$NtCreateSection = {((3f 24 82 e6) | (e6 82 24 3f))}
		$SetPropA = {((7c b0 79 e3) | (e3 79 b0 7c))}
		$GetModuleFileNameExA = {((1a f8 8d e6) | (e6 8d f8 1a))}
		$PathFileExistsA = {((25 07 bb 21) | (21 bb 07 25))}
		$SetFocus = {((90 22 e2 74) | (74 e2 22 90))}
		$GetDCEx = {((ba 22 8d 87) | (87 8d 22 ba))}
		$WNetOpenEnumA = {((7a 97 9d 1d) | (1d 9d 97 7a))}
		$FindFirstFileA = {((ae 17 eb ef) | (ef eb 17 ae))}
		$AttachThreadInput = {((5f 3f 49 ea) | (ea 49 3f 5f))}
		$AdjustTokenPrivileges = {((d9 d4 d3 49) | (49 d3 d4 d9))}
		$EnumProcessModules = {((a7 b6 e4 3b) | (3b e4 b6 a7))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

84cb3390-bb98-46ec-bbd0-4542ed23256b
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
