api_hashes_mult21AddHash32

YARA detection rule by filescanio
Rule api_hashes_mult21AddHash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_mult21AddHash32 : hardened
{
	strings:
		$ControlService = {((46 14 08 52) | (52 08 14 46))}
		$HttpSendRequestA = {((d3 85 96 b4) | (b4 96 85 d3))}
		$SetThreadPriority = {((a5 41 22 06) | (06 22 41 a5))}
		$Recv = {((00 2e b1 f0) | (f0 b1 2e 00))}
		$QueryPerformanceFrequency = {((7c 70 eb da) | (da eb 70 7c))}
		$RegDeleteValueA = {((20 7d 6b ef) | (ef 6b 7d 20))}
		$GetWindowsDirectoryA = {((ef ee f0 41) | (41 f0 ee ef))}
		$CryptSetKeyParam = {((24 ad 0e f8) | (f8 0e ad 24))}
		$RegCreateKeyExA = {((ad a9 81 39) | (39 81 a9 ad))}
		$Module32Next = {((e2 92 2f 2a) | (2a 2f 92 e2))}
		$RegOpenUserClassesRoot = {((1f 27 4b 21) | (21 4b 27 1f))}
		$NtReadVirtualMemoryEx = {((f4 68 06 db) | (db 06 68 f4))}
		$InternetOpenA = {((87 b2 1b 7c) | (7c 1b b2 87))}
		$URLOpenBlockingStream = {((ce 05 ca 9a) | (9a ca 05 ce))}
		$NtSetInformationThread = {((05 0f 3f 6c) | (6c 3f 0f 05))}
		$CreateFileA = {((00 2c fe 15) | (15 fe 2c 00))}
		$UnhookWindowsHookEx = {((11 7d 9c ad) | (ad 9c 7d 11))}
		$GetCurrentThreadId = {((73 f6 ee 48) | (48 ee f6 73))}
		$Accept = {((9e d6 d0 d0) | (d0 d0 d6 9e))}
		$HeapReAlloc = {((32 c7 f9 40) | (40 f9 c7 32))}
		$WinExec = {((25 e6 b9 13) | (13 b9 e6 25))}
		$NtQueueApcThreadEx = {((12 8b 45 50) | (50 45 8b 12))}
		$VirtualAllocFromApp = {((ef d6 1f e7) | (e7 1f d6 ef))}
		$RegLoadKeyA = {((9b 7b 28 08) | (08 28 7b 9b))}
		$OutputDebugStringA = {((1a cb 4b 50) | (50 4b cb 1a))}
		$GetFileAttributesA = {((6d f5 18 88) | (88 18 f5 6d))}
		$SetWaitableTimer = {((46 86 dc f6) | (f6 dc 86 46))}
		$SendMessageA = {((3c c1 7f f0) | (f0 7f c1 3c))}
		$RegUnLoadKeyA = {((37 48 ed eb) | (eb ed 48 37))}
		$SetEnvironmentVariableA = {((b8 bc 40 a8) | (a8 40 bc b8))}
		$VirtualAlloc2 = {((d0 b2 ad 84) | (84 ad b2 d0))}
		$CryptProtectData = {((28 66 f8 4d) | (4d f8 66 28))}
		$GetDesktopWindow = {((5e 5c 59 f2) | (f2 59 5c 5e))}
		$RegGetKeySecurity = {((1a c0 87 5f) | (5f 87 c0 1a))}
		$GetDC = {((05 3e 24 87) | (87 24 3e 05))}
		$LookupPrivilegeValueA = {((5c 31 c4 5f) | (5f c4 31 5c))}
		$CryptGetHashParam = {((c9 4b 9d a7) | (a7 9d 4b c9))}
		$HeapAlloc = {((2d e0 dc 69) | (69 dc e0 2d))}
		$RegCloseKey = {((88 01 6f 1d) | (1d 6f 01 88))}
		$CryptHashData = {((d9 2a 7f 70) | (70 7f 2a d9))}
		$GlobalAlloc = {((cf e7 71 5c) | (5c 71 e7 cf))}
		$RegOverridePredefKey = {((bd 37 8a 1d) | (1d 8a 37 bd))}
		$EnumSystemLocalesA = {((27 97 7a 3e) | (3e 7a 97 27))}
		$GetProcessId = {((f0 e4 03 6c) | (6c 03 e4 f0))}
		$RegLoadMUIStringA = {((81 7a 43 41) | (41 43 7a 81))}
		$SearchPathA = {((ea ee 77 e4) | (e4 77 ee ea))}
		$FindClose = {((c2 ca ba 77) | (77 ba ca c2))}
		$NtDeleteValueKey = {((5d 98 22 fb) | (fb 22 98 5d))}
		$URLDownloadToFile = {((f3 db 3b ae) | (ae 3b db f3))}
		$Toolhelp32ReadProcessMemory = {((d0 5e 27 e0) | (e0 27 5e d0))}
		$GetProcAddress = {((c2 cb c1 5a) | (5a c1 cb c2))}
		$OpenProcessToken = {((07 b0 51 92) | (92 51 b0 07))}
		$HeapCreate = {((ef 0f 3e 32) | (32 3e 0f ef))}
		$UuidFromStringA = {((62 2a 75 63) | (63 75 2a 62))}
		$VirtualProtectEx = {((1a 47 13 25) | (25 13 47 1a))}
		$GetSystemTimeAsFileTime = {((1a 6f 40 d7) | (d7 40 6f 1a))}
		$GetModuleBaseNameA = {((9b e8 8b 43) | (43 8b e8 9b))}
		$lstrcatA = {((57 0c 61 5e) | (5e 61 0c 57))}
		$SetFileAttributesA = {((96 fe b2 14) | (14 b2 fe 96))}
		$FindResourceA = {((cf 74 f9 0a) | (0a f9 74 cf))}
		$WaitForMultipleObjects = {((1e 8e 89 32) | (32 89 8e 1e))}
		$QueryPerformanceCounter = {((a9 fe 4d a8) | (a8 4d fe a9))}
		$NtCreateThreadEx = {((0d 40 a2 2b) | (2b a2 40 0d))}
		$NtContinue = {((42 5c 81 e7) | (e7 81 5c 42))}
		$IsWoW64Process = {((12 4f 27 82) | (82 27 4f 12))}
		$DnsQuery_A = {((b5 56 c4 3b) | (3b c4 56 b5))}
		$VirtualProtectFromApp = {((8e 0a a3 dd) | (dd a3 0a 8e))}
		$GetAsyncKeyState = {((53 58 c7 08) | (08 c7 58 53))}
		$EncryptFileA = {((5b 4b 3a c6) | (c6 3a 4b 5b))}
		$DuplicateToken = {((bd a6 27 bc) | (bc 27 a6 bd))}
		$CryptDeriveKey = {((96 75 36 1a) | (1a 36 75 96))}
		$LockResource = {((bb b7 ce 11) | (11 ce b7 bb))}
		$ResumeThread = {((1b 73 65 e9) | (e9 65 73 1b))}
		$WaitForSingleObjectEx = {((f7 40 57 72) | (72 57 40 f7))}
		$NtSuspendProcess = {((96 3e 3e e3) | (e3 3e 3e 96))}
		$NetShareCheck = {((4b e6 be d8) | (d8 be e6 4b))}
		$OpenThread = {((4a be d8 4a) | (4a d8 be 4a))}
		$URLOpenStream = {((e9 4a b5 f1) | (f1 b5 4a e9))}
		$UnmapViewOfFile = {((3d 14 bf f1) | (f1 bf 14 3d))}
		$CreateFile2 = {((00 2c fe 06) | (06 fe 2c 00))}
		$DeleteService = {((27 f2 6c 44) | (44 6c f2 27))}
		$GetThreadId = {((39 cd ea 45) | (45 ea cd 39))}
		$RegDeleteKeyA = {((8d 0d aa bb) | (bb aa 0d 8d))}
		$CreateTimerQueueTimer = {((b1 f5 ec 7b) | (7b ec f5 b1))}
		$SetProcessDEPPolicy = {((32 63 94 14) | (14 94 63 32))}
		$CreateServiceA = {((86 b8 d4 46) | (46 d4 b8 86))}
		$ExitWindowsEx = {((60 b1 f4 e2) | (e2 f4 b1 60))}
		$NtMapViewOfSection = {((c4 77 c5 25) | (25 c5 77 c4))}
		$NtTerminateThread = {((35 01 3e 23) | (23 3e 01 35))}
		$Process32First = {((86 12 be ac) | (ac be 12 86))}
		$RegCreateKeyTransactedA = {((35 44 fb 65) | (65 fb 44 35))}
		$GetUserNameA = {((43 20 e6 c1) | (c1 e6 20 43))}
		$MapVirtualKeyA = {((ca f5 5a 0f) | (0f 5a f5 ca))}
		$WNetCloseEnum = {((f2 34 52 a9) | (a9 52 34 f2))}
		$InternetReadFileExA = {((87 99 5e c3) | (c3 5e 99 87))}
		$GetComputerNameA = {((ec 98 40 b1) | (b1 40 98 ec))}
		$RegFlushKey = {((5a c7 86 a9) | (a9 86 c7 5a))}
		$VirtualAllocEx = {((e7 08 60 ef) | (ef 60 08 e7))}
		$GetSystemDefaultLangId = {((e1 08 54 59) | (59 54 08 e1))}
		$SetFileTime = {((cd 81 06 fb) | (fb 06 81 cd))}
		$SendNotifyMessageA = {((af 1b 29 a9) | (a9 29 1b af))}
		$LookupAccountNameA = {((e7 7d 2c 29) | (29 2c 7d e7))}
		$NetShareEnum = {((57 a3 59 2f) | (2f 59 a3 57))}
		$IcmpSendEcho = {((37 13 82 12) | (12 82 13 37))}
		$DebugActiveProcessStop = {((33 65 d0 c8) | (c8 d0 65 33))}
		$NtCreateFile = {((bd 03 28 56) | (56 28 03 bd))}
		$DecryptFileA = {((7a 15 7e 1c) | (1c 7e 15 7a))}
		$GetRawInputData = {((39 ba 70 b4) | (b4 70 ba 39))}
		$BringWindowToTop = {((c3 e6 5b 60) | (60 5b e6 c3))}
		$NetShareSetInfo = {((aa 37 6f 12) | (12 6f 37 aa))}
		$GetLogicalDrives = {((72 f0 f8 08) | (08 f8 f0 72))}
		$WriteFile = {((74 20 62 0b) | (0b 62 20 74))}
		$BitBlt = {((a1 a1 49 81) | (81 49 a1 a1))}
		$SendMessageTimeoutA = {((81 1e c0 37) | (37 c0 1e 81))}
		$GetCurrentProcess = {((53 52 15 82) | (82 15 52 53))}
		$RegDeleteTreeA = {((2f 6c af 62) | (62 af 6c 2f))}
		$CreateProcessWithTokenW = {((63 97 a6 e7) | (e7 a6 97 63))}
		$FindWindowA = {((9c d6 61 5a) | (5a 61 d6 9c))}
		$CopyFileA = {((ba 05 c9 1c) | (1c c9 05 ba))}
		$FtpPutFileA = {((59 49 96 64) | (64 96 49 59))}
		$NtOpenProcess = {((e3 08 6b 33) | (33 6b 08 e3))}
		$Send = {((00 2f 3f aa) | (aa 3f 2f 00))}
		$EnumDeviceDrivers = {((fa 0c bd 44) | (44 bd 0c fa))}
		$Process32Next = {((23 1c 2a 03) | (03 2a 1c 23))}
		$GetWindowDC = {((42 2e e7 ff) | (ff e7 2e 42))}
		$CryptDecrypt = {((85 8f df cd) | (cd df 8f 85))}
		$ReadFile = {((f5 4e 4f 1c) | (1c 4f 4e f5))}
		$VirtualProtect = {((77 e9 f7 c8) | (c8 f7 e9 77))}
		$OpenProcess = {((85 cd 35 f1) | (f1 35 cd 85))}
		$WaitForMultipleObjectsEx = {((fc 55 a7 0f) | (0f a7 55 fc))}
		$Inet_addr = {((30 04 12 6a) | (6a 12 04 30))}
		$WSAStartup = {((2b 7a e7 3e) | (3e e7 7a 2b))}
		$Bind = {((00 25 fe 3d) | (3d fe 25 00))}
		$GetTempFileNameA = {((bb 3d f0 b8) | (b8 f0 3d bb))}
		$CreateMutexExA = {((d0 50 10 45) | (45 10 50 d0))}
		$DeviceIoControl = {((6c 6f 0e 69) | (69 0e 6f 6c))}
		$CryptDestroyHash = {((8a 86 87 e0) | (e0 87 86 8a))}
		$CryptEncrypt = {((e7 88 8a 37) | (37 8a 88 e7))}
		$NtSetContextThread = {((d1 e4 8c 8b) | (8b 8c e4 d1))}
		$CryptReleaseContext = {((dd 41 56 18) | (18 56 41 dd))}
		$StretchBlt = {((c1 ab 17 df) | (df 17 ab c1))}
		$NtWaitForSingleObject = {((ec f1 1c 17) | (17 1c f1 ec))}
		$LoadLibraryExA = {((43 1a 42 b3) | (b3 42 1a 43))}
		$PeekMessageA = {((b4 ef 64 ab) | (ab 64 ef b4))}
		$WNetAddConnectionA = {((28 6e 9c 98) | (98 9c 6e 28))}
		$NtCreateThread = {((2b 08 0d 4e) | (4e 0d 08 2b))}
		$ShellExecuteExA = {((01 ca 70 89) | (89 70 ca 01))}
		$GetMessageA = {((e0 64 f1 c6) | (c6 f1 64 e0))}
		$GetCurrentHwProfileA = {((99 0c 66 f4) | (f4 66 0c 99))}
		$PostThreadMessageA = {((31 00 9d 84) | (84 9d 00 31))}
		$RegOpenKeyExA = {((9a 4f 42 37) | (37 42 4f 9a))}
		$CreateWaitableTimer = {((48 d5 1d 3e) | (3e 1d d5 48))}
		$NtSetInformationProcess = {((8a 2a 81 53) | (53 81 2a 8a))}
		$InternetSetOptionA = {((4d eb 3a af) | (af 3a eb 4d))}
		$GetClipboardData = {((cf 5a d8 2a) | (2a d8 5a cf))}
		$HttpSendRequestExA = {((cb 46 34 71) | (71 34 46 cb))}
		$CreateProcessA = {((a2 4f 34 54) | (54 34 4f a2))}
		$CreateToolhelp32Snapshot = {((0b 3c 5e 90) | (90 5e 3c 0b))}
		$GetProcessHeap = {((b9 f2 13 3d) | (3d 13 f2 b9))}
		$MapVirtualKeyExA = {((5d b4 3a 8c) | (8c 3a b4 5d))}
		$NtTerminateProcess = {((b8 5c 56 ea) | (ea 56 5c b8))}
		$CallNextHookEx = {((ff 34 65 89) | (89 65 34 ff))}
		$TerminateProcess = {((a2 e3 88 68) | (68 88 e3 a2))}
		$GetIpNetTable = {((4e 5c 96 48) | (48 96 5c 4e))}
		$SetThreadToken = {((4a f5 1e 05) | (05 1e f5 4a))}
		$SetCurrentDirectory = {((e1 b9 e2 24) | (24 e2 b9 e1))}
		$GetFileTime = {((8d 28 87 ef) | (ef 87 28 8d))}
		$CreateRemoteThread = {((4b 89 23 18) | (18 23 89 4b))}
		$KeInsertQueueApc = {((12 2e 14 3e) | (3e 14 2e 12))}
		$SetWindowsHookExA = {((f4 f3 a7 e6) | (e6 a7 f3 f4))}
		$EnumWindows = {((a9 66 14 e0) | (e0 14 66 a9))}
		$NtSetSystemEnvironmentValueEx = {((11 da e6 e2) | (e2 e6 da 11))}
		$GetKeynameTextA = {((c8 cd 89 d0) | (d0 89 cd c8))}
		$CryptCreateHash = {((df 8d 68 0a) | (0a 68 8d df))}
		$CreateThread = {((26 66 2f cc) | (cc 2f 66 26))}
		$GetCurrentThread = {((22 6d 89 bb) | (bb 89 6d 22))}
		$EnumResourceTypesExA = {((f3 c5 15 b0) | (b0 15 c5 f3))}
		$OpenSCManagerA = {((ae 89 4d c4) | (c4 4d 89 ae))}
		$NtWriteVirtualMemory = {((f0 26 2e 0d) | (0d 2e 26 f0))}
		$WSASocketA = {((1f f1 36 55) | (55 36 f1 1f))}
		$SetWindowLongPtrA = {((ae 17 87 4b) | (4b 87 17 ae))}
		$CryptAcquireContextA = {((fa 19 7a c2) | (c2 7a 19 fa))}
		$Thread32Next = {((10 af 45 5c) | (5c 45 af 10))}
		$RegisterRawInputDevices = {((c9 cc cb a2) | (a2 cb cc c9))}
		$Gethostbyname = {((d7 fc d8 3a) | (3a d8 fc d7))}
		$GetLogicalProcessorInformationEx = {((f6 a0 72 be) | (be 72 a0 f6))}
		$CreateWindowExA = {((83 5d b0 0a) | (0a b0 5d 83))}
		$GetTickCount64 = {((54 e7 b6 5e) | (5e b6 e7 54))}
		$SendMessageCallbackA = {((49 08 05 dd) | (dd 05 08 49))}
		$WNetAddConnection2A = {((36 42 2d ea) | (ea 2d 42 36))}
		$ShellExecuteA = {((cb 1b ec cc) | (cc ec 1b cb))}
		$CryptGenRandom = {((88 e4 48 0d) | (0d 48 e4 88))}
		$RegConnectRegistryA = {((6c 26 0f 42) | (42 0f 26 6c))}
		$CryptBinaryToString = {((fc 8a 77 91) | (91 77 8a fc))}
		$RtlMoveMemory = {((97 07 20 e2) | (e2 20 07 97))}
		$CopyFile2 = {((ba 05 c9 0d) | (0d c9 05 ba))}
		$TimeGetTime = {((87 18 f2 7e) | (7e f2 18 87))}
		$Thread32First = {((26 09 45 25) | (25 45 09 26))}
		$PostMessageA = {((3b 82 62 0c) | (0c 62 82 3b))}
		$WSACleanup = {((49 6c cc 33) | (33 cc 6c 49))}
		$NtShutdownSystem = {((bc da 2b e3) | (e3 2b da bc))}
		$GetModuleFileNameA = {((b5 11 4d 08) | (08 4d 11 b5))}
		$Socket = {((c9 ac ea 49) | (49 ea ac c9))}
		$NtCreateUserProcess = {((2b fc 68 74) | (74 68 fc 2b))}
		$GetCurrentProcessId = {((70 2d 87 cf) | (cf 87 2d 70))}
		$InternetCloseHandle = {((0e af e2 0b) | (0b e2 af 0e))}
		$OpenFileMappingA = {((b5 f9 37 3f) | (3f 37 f9 b5))}
		$NtQueryDirectoryFile = {((03 37 c5 ed) | (ed c5 37 03))}
		$GetAdaptersInfo = {((23 6f dd 60) | (60 dd 6f 23))}
		$MapViewOfFile = {((a4 e3 5b 8e) | (8e 5b e3 a4))}
		$TerminateThread = {((ee 89 37 e1) | (e1 37 89 ee))}
		$ControlServiceExA = {((82 25 34 50) | (50 34 25 82))}
		$CreateProcessInternal = {((83 d5 c7 b0) | (b0 c7 d5 83))}
		$CreateMutexA = {((16 fe 6d 88) | (88 6d fe 16))}
		$WSAIoctl = {((dc 87 eb 46) | (46 eb 87 dc))}
		$RegOpenKeyTransactedA = {((df 22 da 63) | (63 da 22 df))}
		$Connect = {((30 6f 18 4a) | (4a 18 6f 30))}
		$RegQueryInfoKeyA = {((88 ae 58 0a) | (0a 58 ae 88))}
		$RegSetKeySecurity = {((e1 c3 3a eb) | (eb 3a c3 e1))}
		$NtClose = {((87 ce 75 d8) | (d8 75 ce 87))}
		$Sleep = {((06 1a e5 d9) | (d9 e5 1a 06))}
		$NtProtectVirtualMemory = {((b9 17 74 03) | (03 74 17 b9))}
		$NtReadVirtualMemory = {((8e ae 85 fe) | (fe 85 ae 8e))}
		$Gethostname = {((cd 35 e6 1f) | (1f e6 35 cd))}
		$CopyFileExA = {((52 9c a0 d9) | (d9 a0 9c 52))}
		$Wow64SetThreadContext = {((13 2d f8 90) | (90 f8 2d 13))}
		$EnumProcessModulesEx = {((f2 37 5b ea) | (ea 5b 37 f2))}
		$GetSystemDirectoryA = {((b2 b1 e7 7b) | (7b e7 b1 b2))}
		$NtCreateProcess = {((6f 3d 0b 75) | (75 0b 3d 6f))}
		$SetThreadContext = {((c0 55 17 49) | (49 17 55 c0))}
		$DnsQueryEx = {((b5 56 c1 18) | (18 c1 56 b5))}
		$LoadResource = {((84 3b 94 c8) | (c8 94 3b 84))}
		$NtAllocateVirtualMemory = {((36 43 fb e7) | (e7 fb 43 36))}
		$ConnectNamedPipe = {((02 38 46 fd) | (fd 46 38 02))}
		$RegDeleteKeyValueA = {((36 71 6d 98) | (98 6d 71 36))}
		$CreatePipe = {((64 e0 0f a2) | (a2 0f e0 64))}
		$NtDelayExecution = {((4c 7d 89 45) | (45 89 7d 4c))}
		$RtlGetVersion = {((cf a8 54 f8) | (f8 54 a8 cf))}
		$NtOpenThread = {((a2 e7 6d 4c) | (4c 6d e7 a2))}
		$RegReplaceKeyA = {((08 1e 9b e4) | (e4 9b 1e 08))}
		$RtlCreateHeap = {((42 af 6c 64) | (64 6c af 42))}
		$CheckRemoteDebuggerPresent = {((b6 1d c2 d0) | (d0 c2 1d b6))}
		$GetProcessIdOfThread = {((8e 47 1c b9) | (b9 1c 47 8e))}
		$SetForegroundWindow = {((21 2a 57 9f) | (9f 57 2a 21))}
		$SetWinEventHook = {((0d 65 8f 4d) | (4d 8f 65 0d))}
		$RegisterHotKey = {((76 99 85 d9) | (d9 85 99 76))}
		$NtQueryInformationProcess = {((0b d5 c7 bd) | (bd c7 d5 0b))}
		$CreateRemoteThreadEx = {((52 5e 52 75) | (75 52 5e 52))}
		$OpenClipboard = {((0a 52 a7 02) | (02 a7 52 0a))}
		$RegEnumValueA = {((19 69 cb f1) | (f1 cb 69 19))}
		$URLDownloadToCacheFile = {((64 f4 ef e2) | (e2 ef f4 64))}
		$LocalAlloc = {((3e 20 dd 16) | (16 dd 20 3e))}
		$ShowWindow = {((ad 73 66 d9) | (d9 66 73 ad))}
		$VirtualQueryEx = {((cb 2d f1 da) | (da f1 2d cb))}
		$NtQueueApcThread = {((16 95 a3 33) | (33 a3 95 16))}
		$NtMakeTemporaryObject = {((11 9f 68 7a) | (7a 68 9f 11))}
		$VirtualAllocExNuma = {((05 4a 06 20) | (20 06 4a 05))}
		$RegOpenKeyA = {((b7 44 7a fa) | (fa 7a 44 b7))}
		$EnumDesktopWindows = {((01 6e 97 7a) | (7a 97 6e 01))}
		$WaitForSingleObject = {((b9 3b c4 d5) | (d5 c4 3b b9))}
		$FindResourceExA = {((80 97 84 47) | (47 84 97 80))}
		$CryptStringToBinary = {((da 3b 89 91) | (91 89 3b da))}
		$RegEnumKeyA = {((07 fe 22 3d) | (3d 22 fe 07))}
		$Select = {((c8 fc ca e0) | (e0 ca fc c8))}
		$WNetEnumResourceA = {((23 44 94 5c) | (5c 94 44 23))}
		$EnumProcesses = {((04 16 2c cc) | (cc 2c 16 04))}
		$Listen = {((b8 f5 27 2f) | (2f 27 f5 b8))}
		$RegCreateKeyA = {((c9 9f 11 7c) | (7c 11 9f c9))}
		$IsDebuggerPresent = {((6f 66 e8 a2) | (a2 e8 66 6f))}
		$FindNextUrlCacheEntryA = {((c0 ba 76 3a) | (3a 76 ba c0))}
		$StartServiceA = {((11 df 8e 00) | (00 8e df 11))}
		$GetThreadContext = {((2d d7 50 bd) | (bd 50 d7 2d))}
		$VirtualAlloc = {((df 89 4b 12) | (12 4b 89 df))}
		$Module32First = {((34 49 68 b3) | (b3 68 49 34))}
		$FindFirstUrlCacheEntryA = {((63 6f 82 43) | (43 82 6f 63))}
		$SleepEx = {((f8 6b c9 76) | (76 c9 6b f8))}
		$MoveFileA = {((e6 18 73 18) | (18 73 18 e6))}
		$NtSetValueKey = {((88 31 fe 34) | (34 fe 31 88))}
		$SetWindowLongA = {((82 52 d5 55) | (55 d5 52 82))}
		$MapViewOfFileEx = {((6b 28 80 6b) | (6b 80 28 6b))}
		$NtDuplicateObject = {((ac 4d 8e 74) | (74 8e 4d ac))}
		$GetKeyboardState = {((0a 77 95 32) | (32 95 77 0a))}
		$GetSystemTime = {((16 13 8e 94) | (94 8e 13 16))}
		$FindWindowExA = {((2b f4 40 97) | (97 40 f4 2b))}
		$RegQueryMultipleValuesA = {((f4 02 b5 11) | (11 b5 02 f4))}
		$DrawTextExA = {((65 86 d0 71) | (71 d0 86 65))}
		$RegEnumKeyExA = {((00 0f c6 3a) | (3a c6 0f 00))}
		$QueueUserAPC = {((1e 1e 00 38) | (38 00 1e 1e))}
		$RegSaveKeyA = {((0c a7 15 57) | (57 15 a7 0c))}
		$CreateFileMappingA = {((94 98 a8 41) | (41 a8 98 94))}
		$CryptDestroyKey = {((97 97 85 c5) | (c5 85 97 97))}
		$RegDeleteKeyExA = {((07 23 66 38) | (38 66 23 07))}
		$EnumResourceTypesA = {((bc 0d 1c 33) | (33 1c 0d bc))}
		$RegSetKeyValueA = {((76 22 39 71) | (71 39 22 76))}
		$timeSetEvent = {((9a b0 79 dd) | (dd 79 b0 9a))}
		$RegSaveKeyExA = {((d2 c1 e7 d4) | (d4 e7 c1 d2))}
		$CountClipboardFormats = {((db 8b e0 75) | (75 e0 8b db))}
		$HttpAddRequestHeaders = {((dc d9 82 6e) | (6e 82 d9 dc))}
		$NtQueueApcThreadEx2 = {((63 f3 ef 82) | (82 ef f3 63))}
		$RegCopyTreeA = {((a6 cf c1 ca) | (ca c1 cf a6))}
		$ImpersonateLoggedOnUser = {((75 b0 0d f5) | (f5 0d b0 75))}
		$GetDriveTypeA = {((07 c0 21 5d) | (5d 21 c0 07))}
		$GetVersionExA = {((d8 c4 d9 c4) | (c4 d9 c4 d8))}
		$InternetReadFile = {((3d 84 0f a5) | (a5 0f 84 3d))}
		$RegOpenCurrentUser = {((01 2c 48 72) | (72 48 2c 01))}
		$GetThreadLocale = {((ef 92 00 a8) | (a8 00 92 ef))}
		$NtUnmapViewOfSection = {((b3 82 9b 28) | (28 9b 82 b3))}
		$FindNextFileA = {((86 b8 e7 21) | (21 e7 b8 86))}
		$GetLogicalProcessorInformation = {((23 04 9d 21) | (21 9d 04 23))}
		$FlushEfsCache = {((db fb 12 74) | (74 12 fb db))}
		$Closesocket = {((b2 4c 40 ff) | (ff 40 4c b2))}
		$NetShareGetInfo = {((0e 7c 96 06) | (06 96 7c 0e))}
		$GetModuleHandleA = {((9c 49 c0 53) | (53 c0 49 9c))}
		$VirtualAlloc2FromApp = {((41 ae 0e 19) | (19 0e ae 41))}
		$MoveFileExA = {((ce 01 b9 d5) | (d5 b9 01 ce))}
		$NtWaitForMultipleObjects = {((e1 fc b1 34) | (34 b1 fc e1))}
		$DeleteFileA = {((31 6e bf 34) | (34 bf 6e 31))}
		$StartServiceCtrlDispatcherA = {((2f f1 e4 7c) | (7c e4 f1 2f))}
		$HttpOpenRequestA = {((33 31 3a dc) | (dc 3a 31 33))}
		$GetThreadInformation = {((9f 46 53 de) | (de 53 46 9f))}
		$NtDeleteKey = {((0b a6 6f fe) | (fe 6f a6 0b))}
		$InternetWriteFile = {((c3 0e 33 b4) | (b4 33 0e c3))}
		$LoadLibraryA = {((07 1d 2c 76) | (76 2c 1d 07))}
		$RegQueryValueExA = {((ad ca 52 0f) | (0f 52 ca ad))}
		$NtCreateProcessEx = {((32 ad c6 12) | (12 c6 ad 32))}
		$GetForegroundWindow = {((d6 ed 8c 93) | (93 8c ed d6))}
		$NtQuerySystemEnvironmentValueEx = {((33 ff d4 cc) | (cc d4 ff 33))}
		$SizeOfResource = {((7e 5f 8a 78) | (78 8a 5f 7e))}
		$RegGetValueA = {((21 5b d2 5c) | (5c d2 5b 21))}
		$LdrLoadDll = {((cd 59 fb de) | (de fb 59 cd))}
		$NtResumeThread = {((20 15 43 6b) | (6b 43 15 20))}
		$MapViewOfFile3 = {((41 4e cd 81) | (81 cd 4e 41))}
		$NtQueryTimer = {((7a 33 df f9) | (f9 df 33 7a))}
		$RtlCopyMemory = {((e8 9f 37 66) | (66 37 9f e8))}
		$InternetConnectA = {((86 87 e2 54) | (54 e2 87 86))}
		$SetClipboardData = {((61 d8 9e b6) | (b6 9e d8 61))}
		$GetKeyState = {((13 a7 7f 6a) | (6a 7f a7 13))}
		$WriteProcessMemory = {((10 7b 94 83) | (83 94 7b 10))}
		$RtlSetProcessIsCritical = {((f6 95 a3 64) | (64 a3 95 f6))}
		$NetShareAdd = {((cc 5a 36 23) | (23 36 5a cc))}
		$NtResumeProcess = {((05 f1 05 32) | (32 05 f1 05))}
		$GetProcessHeaps = {((f8 34 7b 50) | (50 7b 34 f8))}
		$RegDeleteKeyTransactedA = {((d4 57 6f 64) | (64 6f 57 d4))}
		$ReadProcessMemory = {((41 57 c4 b4) | (b4 c4 57 41))}
		$GetNativeSystemInfo = {((05 cb eb b8) | (b8 eb cb 05))}
		$ioctlsocket = {((1b 73 0e 24) | (24 0e 73 1b))}
		$CreateProcessAsUserA = {((0a 86 52 a7) | (a7 52 86 0a))}
		$PeekNamedPipe = {((27 f5 36 78) | (78 36 f5 27))}
		$SuspendThread = {((1e fb fd 3a) | (3a fd fb 1e))}
		$CallWindowProcA = {((1f d0 18 09) | (09 18 d0 1f))}
		$OpenServiceA = {((23 dd 94 44) | (44 94 dd 23))}
		$SetTimer = {((0c d3 e1 4d) | (4d e1 d3 0c))}
		$MapViewOfFile2 = {((41 4e cd 80) | (80 cd 4e 41))}
		$RegRestoreKeyA = {((20 4f 49 ec) | (ec 49 4f 20))}
		$InternetOpenUrlA = {((d1 91 24 af) | (af 24 91 d1))}
		$GetTempPathA = {((46 56 b5 64) | (64 b5 56 46))}
		$NtAdjustPrivilegesToken = {((37 d2 32 68) | (68 32 d2 37))}
		$GetTickCount = {((e9 0a 52 34) | (34 52 0a e9))}
		$RegSetValueExA = {((27 f2 79 25) | (25 79 f2 27))}
		$NtCreateSection = {((37 08 ee 6b) | (6b ee 08 37))}
		$SetPropA = {((0c 90 78 6e) | (6e 78 90 0c))}
		$GetModuleFileNameExA = {((3e 98 cf c5) | (c5 cf 98 3e))}
		$PathFileExistsA = {((ac c8 a4 2e) | (2e a4 c8 ac))}
		$SetFocus = {((0b d9 ac 0c) | (0c ac d9 0b))}
		$GetDCEx = {((4d 59 6b a4) | (a4 6b 59 4d))}
		$WNetOpenEnumA = {((09 74 4f 86) | (86 4f 74 09))}
		$FindFirstFileA = {((a1 c0 3d 0a) | (0a 3d c0 a1))}
		$AttachThreadInput = {((6b 4f 96 5d) | (5d 96 4f 6b))}
		$AdjustTokenPrivileges = {((6e d0 2f a6) | (a6 2f d0 6e))}
		$EnumProcessModules = {((47 37 4b 4d) | (4d 4b 37 47))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

aabfa91a-57dc-4a47-8efb-2f36ed7ebf5c
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
