api_hashes_imul21hAddHash32

YARA detection rule by filescanio
Rule api_hashes_imul21hAddHash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_imul21hAddHash32 : hardened
{
	strings:
		$ControlService = {((b6 81 60 97) | (97 60 81 b6))}
		$HttpSendRequestA = {((2b c2 38 39) | (39 38 c2 2b))}
		$SetThreadPriority = {((79 e4 6f eb) | (eb 6f e4 79))}
		$Recv = {((7c 8b 35 15) | (15 35 8b 7c))}
		$QueryPerformanceFrequency = {((a9 2b b9 bf) | (bf b9 2b a9))}
		$RegDeleteValueA = {((7f 6b f0 f4) | (f4 f0 6b 7f))}
		$GetWindowsDirectoryA = {((a6 23 9f c6) | (c6 9f 23 a6))}
		$CryptSetKeyParam = {((0c 57 bc 7d) | (7d bc 57 0c))}
		$RegCreateKeyExA = {((0c 98 8e 5e) | (5e 8e 98 0c))}
		$Module32Next = {((0a 53 22 6f) | (6f 22 53 0a))}
		$RegOpenUserClassesRoot = {((2b 6f a3 c6) | (c6 a3 6f 2b))}
		$NtReadVirtualMemoryEx = {((0f 4c d7 00) | (00 d7 4c 0f))}
		$InternetOpenA = {((a7 91 77 61) | (61 77 91 a7))}
		$URLOpenBlockingStream = {((f2 18 9a df) | (df 9a 18 f2))}
		$NtSetInformationThread = {((0c 3c 03 f1) | (f1 03 3c 0c))}
		$CreateFileA = {((68 7d 20 fa) | (fa 20 7d 68))}
		$UnhookWindowsHookEx = {((ca bb 5b b2) | (b2 5b bb ca))}
		$GetCurrentThreadId = {((d5 b0 78 cd) | (cd 78 b0 d5))}
		$Accept = {((a4 60 ac f5) | (f5 ac 60 a4))}
		$HeapReAlloc = {((3a 5f b4 25) | (25 b4 5f 3a))}
		$WinExec = {((dc bd a5 d8) | (d8 a5 bd dc))}
		$NtQueueApcThreadEx = {((3d 92 7b f5) | (f5 7b 92 3d))}
		$VirtualAllocFromApp = {((30 41 62 ec) | (ec 62 41 30))}
		$RegLoadKeyA = {((89 d4 63 0d) | (0d 63 d4 89))}
		$OutputDebugStringA = {((49 0f c1 d5) | (d5 c1 0f 49))}
		$GetFileAttributesA = {((f3 0a ab 0d) | (0d ab 0a f3))}
		$SetWaitableTimer = {((e6 41 76 5b) | (5b 76 41 e6))}
		$SendMessageA = {((ec ab 83 55) | (55 83 ab ec))}
		$RegUnLoadKeyA = {((5e 83 86 10) | (10 86 83 5e))}
		$SetEnvironmentVariableA = {((36 4a 55 ad) | (ad 55 4a 36))}
		$VirtualAlloc2 = {((38 f4 0d 49) | (49 0d f4 38))}
		$CryptProtectData = {((85 a5 85 b2) | (b2 85 a5 85))}
		$GetDesktopWindow = {((46 78 f7 57) | (57 f7 78 46))}
		$RegGetKeySecurity = {((9a fa 7d 64) | (64 7d fa 9a))}
		$GetDC = {((0d 2b 10 6c) | (6c 10 2b 0d))}
		$LookupPrivilegeValueA = {((1e 34 40 64) | (64 40 34 1e))}
		$CryptGetHashParam = {((5d e9 f7 ac) | (ac f7 e9 5d))}
		$HeapAlloc = {((ad c4 06 2e) | (2e 06 c4 ad))}
		$RegCloseKey = {((76 49 a6 02) | (02 a6 49 76))}
		$CryptHashData = {((7f 12 f3 55) | (55 f3 12 7f))}
		$GlobalAlloc = {((38 37 94 21) | (21 94 37 38))}
		$RegOverridePredefKey = {((81 a8 bd a2) | (a2 bd a8 81))}
		$EnumSystemLocalesA = {((88 6a 7c c3) | (c3 7c 6a 88))}
		$GetProcessId = {((a8 21 8e d1) | (d1 8e 21 a8))}
		$RegLoadMUIStringA = {((06 45 6d a6) | (a6 6d 45 06))}
		$SearchPathA = {((53 3e 9a c9) | (c9 9a 3e 53))}
		$FindClose = {((42 ad e4 3c) | (3c e4 ad 42))}
		$NtDeleteValueKey = {((ff 70 d4 80) | (80 d4 70 ff))}
		$URLDownloadToFile = {((7a 8d 01 f3) | (f3 01 8d 7a))}
		$Toolhelp32ReadProcessMemory = {((a7 a6 86 e5) | (e5 86 a6 a7))}
		$GetProcAddress = {((de cf c1 bf) | (bf c1 cf de))}
		$OpenProcessToken = {((d9 f5 66 f7) | (f7 66 f5 d9))}
		$HeapCreate = {((6b 57 a0 77) | (77 a0 57 6b))}
		$UuidFromStringA = {((a2 e6 7a 68) | (68 7a e6 a2))}
		$VirtualProtectEx = {((5b 6b 90 8a) | (8a 90 6b 5b))}
		$GetSystemTimeAsFileTime = {((7a 14 b6 1c) | (1c b6 14 7a))}
		$GetModuleBaseNameA = {((07 38 a5 e8) | (e8 a5 38 07))}
		$lstrcatA = {((5e 43 3a 83) | (83 3a 43 5e))}
		$SetFileAttributesA = {((1c 14 44 99) | (99 44 14 1c))}
		$FindResourceA = {((7c 9f 64 ef) | (ef 64 9f 7c))}
		$WaitForMultipleObjects = {((c5 ed c1 b7) | (b7 c1 ed c5))}
		$QueryPerformanceCounter = {((75 24 52 8d) | (8d 52 24 75))}
		$NtCreateThreadEx = {((af 18 cf b0) | (b0 cf 18 af))}
		$NtContinue = {((fc 3a 6c 2c) | (2c 6c 3a fc))}
		$IsWoW64Process = {((22 7a 50 07) | (07 50 7a 22))}
		$DnsQuery_A = {((86 41 ae c0) | (c0 ae 41 86))}
		$VirtualProtectFromApp = {((a3 c9 a7 e2) | (e2 a7 c9 a3))}
		$GetAsyncKeyState = {((7b 4d fc 8d) | (8d fc 4d 7b))}
		$EncryptFileA = {((85 3d b2 2b) | (2b b2 3d 85))}
		$DuplicateToken = {((91 0e f8 01) | (01 f8 0e 91))}
		$CryptDeriveKey = {((f7 29 9e 7f) | (7f 9e 29 f7))}
		$LockResource = {((6b a1 d1 56) | (56 d1 a1 6b))}
		$ResumeThread = {((8d c7 e1 2e) | (2e e1 c7 8d))}
		$WaitForSingleObjectEx = {((51 2e 1b 97) | (97 1b 2e 51))}
		$NtSuspendProcess = {((4f 23 64 48) | (48 64 23 4f))}
		$NetShareCheck = {((ed 18 3e bd) | (bd 3e 18 ed))}
		$OpenThread = {((c7 07 3a 8f) | (8f 3a 07 c7))}
		$URLOpenStream = {((9c e0 8e 16) | (16 8e e0 9c))}
		$UnmapViewOfFile = {((fe fb 48 f6) | (f6 48 fb fe))}
		$CreateFile2 = {((68 7d 20 cb) | (cb 20 7d 68))}
		$DeleteService = {((e4 d6 50 09) | (09 50 d6 e4))}
		$GetThreadId = {((28 15 9d 2a) | (2a 9d 15 28))}
		$RegDeleteKeyA = {((2c 0d a6 c0) | (c0 a6 0d 2c))}
		$CreateTimerQueueTimer = {((ac e8 88 80) | (80 88 e8 ac))}
		$SetProcessDEPPolicy = {((3d 75 2f 59) | (59 2f 75 3d))}
		$CreateServiceA = {((e0 19 30 ab) | (ab 30 19 e0))}
		$ExitWindowsEx = {((0d dc 64 c7) | (c7 64 dc 0d))}
		$NtMapViewOfSection = {((d6 64 9b ca) | (ca 9b 64 d6))}
		$NtTerminateThread = {((cc f5 88 08) | (08 88 f5 cc))}
		$Process32First = {((59 7b 8e f1) | (f1 8e 7b 59))}
		$RegCreateKeyTransactedA = {((36 e2 cc 8a) | (8a cc e2 36))}
		$GetUserNameA = {((fc a1 7e 46) | (46 7e a1 fc))}
		$MapVirtualKeyA = {((47 c3 4e 94) | (94 4e c3 47))}
		$WNetCloseEnum = {((bd db f6 ae) | (ae f6 db bd))}
		$InternetReadFileExA = {((55 2f 9d e8) | (e8 9d 2f 55))}
		$GetComputerNameA = {((8c 52 da 36) | (36 da 52 8c))}
		$RegFlushKey = {((49 0f bd 8e) | (8e bd 0f 49))}
		$VirtualAllocEx = {((57 75 bd 54) | (54 bd 75 57))}
		$GetSystemDefaultLangId = {((0f 41 08 fe) | (fe 08 41 0f))}
		$SetFileTime = {((bb da 41 e0) | (e0 41 da bb))}
		$SendNotifyMessageA = {((0f ee 2c 2e) | (2e 2c ee 0f))}
		$LookupAccountNameA = {((78 bd 1a ae) | (ae 1a bd 78))}
		$NetShareEnum = {((0e f2 6c 94) | (94 6c f2 0e))}
		$IcmpSendEcho = {((e7 0f 11 77) | (77 11 0f e7))}
		$DebugActiveProcessStop = {((16 af e9 4d) | (4d e9 af 16))}
		$NtCreateFile = {((66 16 3f bb) | (bb 3f 16 66))}
		$DecryptFileA = {((a4 07 f5 81) | (81 f5 07 a4))}
		$GetRawInputData = {((dd a3 8d b9) | (b9 8d a3 dd))}
		$BringWindowToTop = {((23 56 f4 e5) | (e5 f4 56 23))}
		$NetShareSetInfo = {((5d da 04 17) | (17 04 da 5d))}
		$GetLogicalDrives = {((5b 0d 95 6d) | (6d 95 0d 5b))}
		$WriteFile = {((f1 d2 07 d0) | (d0 07 d2 f1))}
		$BitBlt = {((a7 2b ad c6) | (c6 ad 2b a7))}
		$SendMessageTimeoutA = {((f4 fe 8b 3c) | (3c 8b fe f4))}
		$GetCurrentProcess = {((3f 02 5f 67) | (67 5f 02 3f))}
		$RegDeleteTreeA = {((ae 6c 27 e7) | (e7 27 6c ae))}
		$CreateProcessWithTokenW = {((f3 e5 48 0c) | (0c 48 e5 f3))}
		$FindWindowA = {((a2 2b 0c 3f) | (3f 0c 2b a2))}
		$CopyFileA = {((39 e8 f3 01) | (01 f3 e8 39))}
		$FtpPutFileA = {((49 d4 55 69) | (69 55 d4 49))}
		$NtOpenProcess = {((4b 82 f7 18) | (18 f7 82 4b))}
		$Send = {((7c 8b c2 cf) | (cf c2 8b 7c))}
		$EnumDeviceDrivers = {((69 97 03 29) | (29 03 97 69))}
		$Process32Next = {((40 ca 01 c8) | (c8 01 ca 40))}
		$GetWindowDC = {((30 76 9b 04) | (04 9b 76 30))}
		$CryptDecrypt = {((4c 86 df 12) | (12 df 86 4c))}
		$ReadFile = {((84 d1 50 61) | (61 50 d1 84))}
		$VirtualProtect = {((e8 57 50 0d) | (0d 50 57 e8))}
		$OpenProcess = {((8b 21 e0 b6) | (b6 e0 21 8b))}
		$WaitForMultipleObjectsEx = {((f8 65 14 b4) | (b4 14 65 f8))}
		$Inet_addr = {((af e7 3c 2f) | (2f 3c e7 af))}
		$WSAStartup = {((14 2e 89 c3) | (c3 89 2e 14))}
		$Bind = {((7c 82 81 62) | (62 81 82 7c))}
		$GetTempFileNameA = {((ea 86 aa 5d) | (5d aa 86 ea))}
		$CreateMutexExA = {((29 b0 f4 ca) | (ca f4 b0 29))}
		$DeviceIoControl = {((91 22 8b 4e) | (4e 8b 22 91))}
		$CryptDestroyHash = {((e7 c5 15 45) | (45 15 c5 e7))}
		$CryptEncrypt = {((ae 7f 89 7c) | (7c 89 7f ae))}
		$NtSetContextThread = {((ff a0 bf 10) | (10 bf a0 ff))}
		$CryptReleaseContext = {((67 47 98 fd) | (fd 98 47 67))}
		$StretchBlt = {((f3 4e ee 24) | (24 ee 4e f3))}
		$NtWaitForSingleObject = {((e8 ac 0c 3c) | (3c 0c ac e8))}
		$LoadLibraryExA = {((95 92 af 38) | (38 af 92 95))}
		$PeekMessageA = {((64 d9 68 10) | (10 68 d9 64))}
		$WNetAddConnectionA = {((07 d9 eb 3d) | (3d eb d9 07))}
		$NtCreateThread = {((65 3e 8d b3) | (b3 8d 3e 65))}
		$ShellExecuteExA = {((78 fa e1 8e) | (8e e1 fa 78))}
		$GetMessageA = {((ce ac a0 ab) | (ab a0 ac ce))}
		$GetCurrentHwProfileA = {((d7 7b b2 99) | (99 b2 7b d7))}
		$PostThreadMessageA = {((91 d3 a0 09) | (09 a0 d3 91))}
		$RegOpenKeyExA = {((83 e3 4e 5c) | (5c 4e e3 83))}
		$CreateWaitableTimer = {((b9 b0 d4 23) | (23 d4 b0 b9))}
		$NtSetInformationProcess = {((76 ef d6 58) | (58 d6 ef 76))}
		$InternetSetOptionA = {((df 16 29 34) | (34 29 16 df))}
		$GetClipboardData = {((6c e3 ed 8f) | (8f ed e3 6c))}
		$HttpSendRequestExA = {((25 31 47 16) | (16 47 31 25))}
		$CreateProcessA = {((fb af 90 b9) | (b9 90 af fb))}
		$CreateToolhelp32Snapshot = {((e2 9a 7b f5) | (f5 7b 9a e2))}
		$GetProcessHeap = {((36 c0 07 a2) | (a2 07 c0 36))}
		$MapVirtualKeyExA = {((45 d1 60 31) | (31 60 d1 45))}
		$NtTerminateProcess = {((4e d9 dd 4f) | (4f dd d9 4e))}
		$CallNextHookEx = {((9c 51 62 0e) | (0e 62 51 9c))}
		$TerminateProcess = {((f3 c1 79 ad) | (ad 79 c1 f3))}
		$GetIpNetTable = {((77 c8 b2 4d) | (4d b2 c8 77))}
		$SetThreadToken = {((c9 f4 96 6a) | (6a 96 f4 c9))}
		$SetCurrentDirectory = {((7a a4 35 09) | (09 35 a4 7a))}
		$GetFileTime = {((7b 81 c2 d4) | (d4 c2 81 7b))}
		$CreateRemoteThread = {((25 2b 15 7d) | (7d 15 2b 25))}
		$KeInsertQueueApc = {((b4 06 c5 c3) | (c3 c5 06 b4))}
		$SetWindowsHookExA = {((e0 a4 7a 0b) | (0b 7a a4 e0))}
		$EnumWindows = {((ae ba bf a5) | (a5 bf ba ae))}
		$NtSetSystemEnvironmentValueEx = {((7e 9f 9f 27) | (27 9f 9f 7e))}
		$GetKeynameTextA = {((df 5a 0a d5) | (d5 0a 5a df))}
		$CryptCreateHash = {((56 ce dc ef) | (ef dc ce 56))}
		$CreateThread = {((98 ba ab 11) | (11 ab ba 98))}
		$GetCurrentThread = {((0a 8a 27 20) | (20 27 8a 0a))}
		$EnumResourceTypesExA = {((dc 4b 41 55) | (55 41 4b dc))}
		$OpenSCManagerA = {((18 c9 ee 69) | (69 ee c9 18))}
		$NtWriteVirtualMemory = {((c3 17 01 92) | (92 01 17 c3))}
		$WSASocketA = {((08 a4 d8 fa) | (fa d8 a4 08))}
		$SetWindowLongPtrA = {((82 cc 61 70) | (70 61 cc 82))}
		$CryptAcquireContextA = {((c4 e8 1a 47) | (47 1a e8 c4))}
		$Thread32Next = {((38 70 38 a1) | (a1 38 70 38))}
		$RegisterRawInputDevices = {((59 87 f0 a7) | (a7 f0 87 59))}
		$Gethostbyname = {((f5 99 23 df) | (df 23 99 f5))}
		$GetLogicalProcessorInformationEx = {((7f 54 8c 63) | (63 8c 54 7f))}
		$CreateWindowExA = {((08 ca 1d 0f) | (0f 1d ca 08))}
		$GetTickCount64 = {((70 eb b6 c3) | (c3 b6 eb 70))}
		$SendMessageCallbackA = {((38 e1 2d 62) | (62 2d e1 38))}
		$WNetAddConnection2A = {((03 17 4d 0f) | (0f 4d 17 03))}
		$ShellExecuteA = {((70 f2 d4 b1) | (b1 d4 f2 70))}
		$CryptGenRandom = {((34 3d 3c 72) | (72 3c 3d 34))}
		$RegConnectRegistryA = {((05 10 62 47) | (47 62 10 05))}
		$CryptBinaryToString = {((ba 28 d2 96) | (96 d2 28 ba))}
		$RtlMoveMemory = {((80 9a a4 c7) | (c7 a4 9a 80))}
		$CopyFile2 = {((39 e8 f2 d2) | (d2 f2 e8 39))}
		$TimeGetTime = {((8c 7f 29 63) | (63 29 7f 8c))}
		$Thread32First = {((45 e8 a0 ea) | (ea a0 e8 45))}
		$PostMessageA = {((eb 6c 65 71) | (71 65 6c eb))}
		$WSACleanup = {((32 20 6e b8) | (b8 6e 20 32))}
		$NtShutdownSystem = {((21 1c cd 48) | (48 cd 1c 21))}
		$GetModuleFileNameA = {((20 61 67 ad) | (ad 67 61 20))}
		$Socket = {((cf 36 c6 6e) | (6e c6 36 cf))}
		$NtCreateUserProcess = {((54 ce 5f 79) | (79 5f ce 54))}
		$GetCurrentProcessId = {((09 17 de d4) | (d4 de 17 09))}
		$InternetCloseHandle = {((87 a3 14 f0) | (f0 14 a3 87))}
		$OpenFileMappingA = {((0e 35 d8 c4) | (c4 d8 35 0e))}
		$NtQueryDirectoryFile = {((8b 95 11 72) | (72 11 95 8b))}
		$GetAdaptersInfo = {((37 ca da 45) | (45 da ca 37))}
		$MapViewOfFile = {((8e 88 6b 93) | (93 6b 88 8e))}
		$TerminateThread = {((2f 0c 10 a6) | (a6 10 0c 2f))}
		$ControlServiceExA = {((e7 d9 5e 55) | (55 5e d9 e7))}
		$CreateProcessInternal = {((83 6d cb 95) | (95 cb 6d 83))}
		$CreateMutexA = {((89 52 e8 ed) | (ed e8 52 89))}
		$WSAIoctl = {((58 29 1c cb) | (cb 1c 29 58))}
		$RegOpenKeyTransactedA = {((c3 f4 aa 88) | (88 aa f4 c3))}
		$Connect = {((e7 34 78 ef) | (ef 78 34 e7))}
		$RegQueryInfoKeyA = {((ae 72 09 af) | (af 09 72 ae))}
		$RegSetKeySecurity = {((61 fd 30 f0) | (f0 30 fd 61))}
		$NtClose = {((40 d6 e6 9d) | (9d e6 d6 40))}
		$Sleep = {((0e 07 cd 7e) | (7e cd 07 0e))}
		$NtProtectVirtualMemory = {((50 e9 28 88) | (88 28 e9 50))}
		$NtReadVirtualMemory = {((a3 28 81 03) | (03 81 28 a3))}
		$Gethostname = {((33 42 f8 c4) | (c4 f8 42 33))}
		$CopyFileExA = {((57 f1 d3 de) | (de d3 f1 57))}
		$Wow64SetThreadContext = {((33 6b 2c 95) | (95 2c 6b 33))}
		$EnumProcessModulesEx = {((e2 10 87 6f) | (6f 87 10 e2))}
		$GetSystemDirectoryA = {((3d 60 3e 80) | (80 3e 60 3d))}
		$NtCreateProcess = {((f0 43 98 5a) | (5a 98 43 f0))}
		$SetThreadContext = {((fd 14 38 ae) | (ae 38 14 fd))}
		$DnsQueryEx = {((86 41 ab 7d) | (7d ab 41 86))}
		$LoadResource = {((34 25 98 0d) | (0d 98 25 34))}
		$NtAllocateVirtualMemory = {((f7 83 b8 ec) | (ec b8 83 f7))}
		$ConnectNamedPipe = {((43 6e 4c 62) | (62 4c 6e 43))}
		$RegDeleteKeyValueA = {((ea 23 8c 3d) | (3d 8c 23 ea))}
		$CreatePipe = {((96 94 e9 e7) | (e7 e9 94 96))}
		$NtDelayExecution = {((f5 a9 36 aa) | (aa 36 a9 f5))}
		$RtlGetVersion = {((0d de 5c dd) | (dd 5c de 0d))}
		$NtOpenThread = {((96 8e 0c b1) | (b1 0c 8e 96))}
		$RegReplaceKeyA = {((84 ec 90 69) | (69 90 ec 84))}
		$RtlCreateHeap = {((e1 af 68 49) | (49 68 af e1))}
		$CheckRemoteDebuggerPresent = {((01 15 79 55) | (55 79 15 01))}
		$GetProcessIdOfThread = {((17 5b 7c 5e) | (5e 7c 5b 17))}
		$SetForegroundWindow = {((75 2b 9e 84) | (84 9e 2b 75))}
		$SetWinEventHook = {((b1 4e ac 52) | (52 ac 4e b1))}
		$RegisterHotKey = {((92 64 e2 3e) | (3e e2 64 92))}
		$NtQueryInformationProcess = {((8c dc 5d c2) | (c2 5d dc 8c))}
		$CreateRemoteThreadEx = {((1c 46 71 fa) | (fa 71 46 1c))}
		$OpenClipboard = {((b7 7d 12 c7) | (c7 12 7d b7))}
		$RegEnumValueA = {((02 fd 4f f6) | (f6 4f fd 02))}
		$URLDownloadToCacheFile = {((3e 62 cc c7) | (c7 cc 62 3e))}
		$LocalAlloc = {((72 07 3b 5b) | (5b 3b 07 72))}
		$ShowWindow = {((29 bb c9 1e) | (1e c9 bb 29))}
		$VirtualQueryEx = {((3b 9b 4e 3f) | (3f 4e 9b 3b))}
		$NtQueueApcThread = {((0a 66 64 b8) | (b8 64 66 0a))}
		$NtMakeTemporaryObject = {((ee ee ac 7f) | (7f ac ee ee))}
		$VirtualAllocExNuma = {((6c 28 80 a5) | (a5 80 28 6c))}
		$RegOpenKeyA = {((a5 9d b5 ff) | (ff b5 9d a5))}
		$EnumDesktopWindows = {((79 4e 95 df) | (df 95 4e 79))}
		$WaitForSingleObject = {((0d f1 b3 da) | (da b3 f1 0d))}
		$FindResourceExA = {((22 0c 79 4c) | (4c 79 0c 22))}
		$CryptStringToBinary = {((97 d9 e4 96) | (96 e4 d9 97))}
		$RegEnumKeyA = {((f6 57 5d 42) | (42 5d 57 f6))}
		$Select = {((ce 86 a7 05) | (05 a7 86 ce))}
		$WNetEnumResourceA = {((09 ba 1e 81) | (81 1e ba 09))}
		$EnumProcesses = {((b1 40 98 91) | (91 98 40 b1))}
		$Listen = {((be 7f 03 54) | (54 03 7f be))}
		$RegCreateKeyA = {((68 9f 0d 81) | (81 0d 9f 68))}
		$IsDebuggerPresent = {((5b fd b6 87) | (87 b6 fd 5b))}
		$FindNextUrlCacheEntryA = {((be 27 4e ff) | (ff 4e 27 be))}
		$StartServiceA = {((b7 b6 75 e5) | (e5 75 b6 b7))}
		$GetThreadContext = {((6a 96 72 22) | (22 72 96 6a))}
		$VirtualAlloc = {((09 7b c2 57) | (57 c2 7b 09))}
		$Module32First = {((54 28 c4 78) | (78 c4 28 54))}
		$FindFirstUrlCacheEntryA = {((46 19 63 88) | (88 63 19 46))}
		$SleepEx = {((af 31 2e 3b) | (3b 2e 31 af))}
		$MoveFileA = {((65 fb 9c fd) | (fd 9c fb 65))}
		$NtSetValueKey = {((d9 a0 16 39) | (39 16 a0 d9))}
		$SetWindowLongA = {((01 52 4d da) | (da 4d 52 01))}
		$MapViewOfFileEx = {((52 51 a5 90) | (90 a5 51 52))}
		$NtDuplicateObject = {((44 41 d8 59) | (59 d8 41 44))}
		$GetKeyboardState = {((aa 32 2e 97) | (97 2e 32 aa))}
		$GetSystemTime = {((b5 13 8a 79) | (79 8a 13 b5))}
		$FindWindowExA = {((d9 1f 34 9c) | (9c 34 1f d9))}
		$RegQueryMultipleValuesA = {((ea 37 fa 36) | (36 fa 37 ea))}
		$DrawTextExA = {((6a dc 03 76) | (76 03 dc 6a))}
		$RegEnumKeyExA = {((e9 a3 d2 5f) | (5f d2 a3 e9))}
		$QueueUserAPC = {((e5 15 8b dd) | (dd 8b 15 e5))}
		$RegSaveKeyA = {((fb 00 50 5c) | (5c 50 00 fb))}
		$CreateFileMappingA = {((ab d0 22 c6) | (c6 22 d0 ab))}
		$CryptDestroyKey = {((0e c7 f6 aa) | (aa f6 c7 0e))}
		$RegDeleteKeyExA = {((66 12 73 5d) | (5d 73 12 66))}
		$EnumResourceTypesA = {((df 4a 96 b8) | (b8 96 4a df))}
		$RegSetKeyValueA = {((64 9e de 96) | (96 de 9e 64))}
		$timeSetEvent = {((2e 71 e1 22) | (22 e1 71 2e))}
		$RegSaveKeyExA = {((bc 55 f3 f9) | (f9 f3 55 bc))}
		$CountClipboardFormats = {((0f e7 e4 5a) | (5a e4 e7 0f))}
		$HttpAddRequestHeaders = {((4d d4 3e 73) | (73 3e d4 4d))}
		$NtQueueApcThreadEx2 = {((ef e1 fa a7) | (a7 fa e1 ef))}
		$RegCopyTreeA = {((60 50 59 4f) | (4f 59 50 60))}
		$ImpersonateLoggedOnUser = {((47 ec 82 fa) | (fa 82 ec 47))}
		$GetDriveTypeA = {((a8 f1 a1 62) | (62 a1 f1 a8))}
		$GetVersionExA = {((77 b3 d1 c9) | (c9 d1 b3 77))}
		$InternetReadFile = {((77 66 91 0a) | (0a 91 66 77))}
		$RegOpenCurrentUser = {((86 53 66 f7) | (f7 66 53 86))}
		$GetThreadLocale = {((4e 80 85 8d) | (8d 85 80 4e))}
		$NtUnmapViewOfSection = {((6a a4 12 cd) | (cd 12 a4 6a))}
		$FindNextFileA = {((36 26 63 26) | (26 63 26 36))}
		$GetLogicalProcessorInformation = {((4d ed 81 a6) | (a6 81 ed 4d))}
		$FlushEfsCache = {((84 15 0a 59) | (59 0a 15 84))}
		$Closesocket = {((18 59 53 a4) | (a4 53 59 18))}
		$NetShareGetInfo = {((c2 1f 2b 0b) | (0b 2b 1f c2))}
		$GetModuleHandleA = {((d9 08 e1 d8) | (d8 e1 08 d9))}
		$VirtualAlloc2FromApp = {((a6 7d a9 9e) | (9e a9 7d a6))}
		$MoveFileExA = {((d3 56 ec da) | (da ec 56 d3))}
		$NtWaitForMultipleObjects = {((8e de d6 d9) | (d9 d6 de 8e))}
		$DeleteFileA = {((99 be e2 19) | (19 e2 be 99))}
		$StartServiceCtrlDispatcherA = {((df 85 73 a1) | (a1 73 85 df))}
		$HttpOpenRequestA = {((8b 6d dc 61) | (61 dc 6d 8b))}
		$GetThreadInformation = {((7f bf 87 43) | (43 87 bf 7f))}
		$NtDeleteKey = {((01 42 2a e3) | (e3 2a 42 01))}
		$InternetWriteFile = {((37 0f 5d 99) | (99 5d 0f 37))}
		$LoadLibraryA = {((b7 07 2f db) | (db 2f 07 b7))}
		$RegQueryValueExA = {((d3 7c ff b4) | (b4 ff 7c d3))}
		$NtCreateProcessEx = {((0f 8b 20 17) | (17 20 8b 0f))}
		$GetForegroundWindow = {((2a ee d3 78) | (78 d3 ee 2a))}
		$NtQuerySystemEnvironmentValueEx = {((2b 32 8e 11) | (11 8e 32 2b))}
		$SizeOfResource = {((59 12 0a dd) | (dd 0a 12 59))}
		$RegGetValueA = {((23 3e 6d e1) | (e1 6d 3e 23))}
		$LdrLoadDll = {((9e 45 6a 43) | (43 6a 45 9e))}
		$NtResumeThread = {((5a 4b c3 d0) | (d0 c3 4b 5a))}
		$MapViewOfFile3 = {((5f 95 de 06) | (06 de 95 5f))}
		$NtQueryTimer = {((25 78 7b 5e) | (5e 7b 78 25))}
		$RtlCopyMemory = {((d2 32 bb 4b) | (4b bb 32 d2))}
		$InternetConnectA = {((c0 58 d7 b9) | (b9 d7 58 c0))}
		$SetClipboardData = {((ff 61 b4 1b) | (1b b4 61 ff))}
		$GetKeyState = {((04 32 3e 4f) | (4f 3e 32 04))}
		$WriteProcessMemory = {((b7 93 0a e8) | (e8 0a 93 b7))}
		$RtlSetProcessIsCritical = {((49 5e 98 89) | (89 98 5e 49))}
		$NetShareAdd = {((ba a2 6d 08) | (08 6d a2 ba))}
		$NtResumeProcess = {((86 f7 92 17) | (17 92 f7 86))}
		$GetProcessHeaps = {((0e c0 fc 35) | (35 fc c0 0e))}
		$RegDeleteKeyTransactedA = {((d5 f5 40 89) | (89 40 f5 d5))}
		$ReadProcessMemory = {((5c 3f 86 99) | (99 86 3f 5c))}
		$GetNativeSystemInfo = {((90 8b ce bd) | (bd ce 8b 90))}
		$ioctlsocket = {((d5 e9 78 a9) | (a9 78 e9 d5))}
		$CreateProcessAsUserA = {((ed be 7a 4c) | (4c 7a be ed))}
		$PeekNamedPipe = {((d5 31 2e 5d) | (5d 2e 31 d5))}
		$SuspendThread = {((87 3d 5c ff) | (ff 5c 3d 87))}
		$CallWindowProcA = {((c3 87 95 0e) | (0e 95 87 c3))}
		$OpenServiceA = {((d3 c7 97 a9) | (a9 97 c7 d3))}
		$SetTimer = {((9e 88 66 92) | (92 66 88 9e))}
		$MapViewOfFile2 = {((5f 95 de 05) | (05 de 95 5f))}
		$RegRestoreKeyA = {((9d 1d 3e 71) | (71 3e 1d 9d))}
		$InternetOpenUrlA = {((0b 73 a6 34) | (34 a6 73 0b))}
		$GetTempPathA = {((ff d7 4c e9) | (e9 4c d7 ff))}
		$NtAdjustPrivilegesToken = {((2d bc 73 6d) | (6d 73 bc 2d))}
		$GetTickCount = {((a2 8a e9 99) | (99 e9 8a a2))}
		$RegSetValueExA = {((2c ea 05 ca) | (ca 05 ea 2c))}
		$NtCreateSection = {((b8 0f 7b 50) | (50 7b 0f b8))}
		$SetPropA = {((9e 44 fd d3) | (d3 fd 44 9e))}
		$GetModuleFileNameExA = {((be 5a 23 8a) | (8a 23 5a be))}
		$PathFileExistsA = {((ed 84 a9 33) | (33 a9 84 ed))}
		$SetFocus = {((9d 8e 31 51) | (51 31 8e 9d))}
		$GetDCEx = {((04 30 e4 a9) | (a9 e4 30 04))}
		$WNetOpenEnumA = {((d7 4d 77 ab) | (ab 77 4d d7))}
		$FindFirstFileA = {((f6 7b 31 8f) | (8f 31 7b f6))}
		$AttachThreadInput = {((fd 8a cc 42) | (42 cc 8a fd))}
		$AdjustTokenPrivileges = {((67 7f bb 8b) | (8b bb 7f 67))}
		$EnumProcessModules = {((bf 17 49 b2) | (b2 49 17 bf))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4c758ec0-a98d-4464-a958-bd2d3e9874cc
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
