api_hashes_add1505Shl5Hash32

YARA detection rule by filescanio
Rule api_hashes_add1505Shl5Hash32 (No description metadata provided).
import "math"
import "pe"
rule api_hashes_add1505Shl5Hash32 : hardened
{
	strings:
		$ControlService = {((52 7a 02 17) | (17 02 7a 52))}
		$HttpSendRequestA = {((91 51 15 b9) | (b9 15 51 91))}
		$SetThreadPriority = {((1c 7c 81 ab) | (ab 81 7c 1c))}
		$Recv = {((7c 8b c1 75) | (75 c1 8b 7c))}
		$QueryPerformanceFrequency = {((40 d0 20 7f) | (7f 20 d0 40))}
		$RegDeleteValueA = {((b9 a2 9e 54) | (54 9e a2 b9))}
		$GetWindowsDirectoryA = {((95 bc 69 c6) | (c6 69 bc 95))}
		$CryptSetKeyParam = {((e2 78 8d fd) | (fd 8d 78 e2))}
		$RegCreateKeyExA = {((46 ce b3 9e) | (9e b3 ce 46))}
		$Module32Next = {((3b 34 f3 af) | (af f3 34 3b))}
		$RegOpenUserClassesRoot = {((6e 39 39 e6) | (e6 39 39 6e))}
		$NtReadVirtualMemoryEx = {((53 e4 b1 00) | (00 b1 e4 53))}
		$InternetOpenA = {((f4 ad 70 a1) | (a1 70 ad f4))}
		$URLOpenBlockingStream = {((2d 82 74 bf) | (bf 74 82 2d))}
		$NtSetInformationThread = {((54 21 2e 31) | (31 2e 21 54))}
		$CreateFileA = {((eb 96 c5 fa) | (fa c5 96 eb))}
		$UnhookWindowsHookEx = {((45 0f 79 92) | (92 79 0f 45))}
		$GetCurrentThreadId = {((d2 9e 42 8d) | (8d 42 9e d2))}
		$Accept = {((a6 b5 d5 95) | (95 d5 b5 a6))}
		$HeapReAlloc = {((1e 31 c1 25) | (25 c1 31 1e))}
		$WinExec = {((29 a6 56 78) | (78 56 a6 29))}
		$NtQueueApcThreadEx = {((71 32 99 95) | (95 99 32 71))}
		$VirtualAllocFromApp = {((23 67 fc cc) | (cc fc 67 23))}
		$RegLoadKeyA = {((86 e4 ef ed) | (ed ef e4 86))}
		$OutputDebugStringA = {((79 72 9f 95) | (95 9f 72 79))}
		$GetFileAttributesA = {((cc 9c 6c cd) | (cd 6c 9c cc))}
		$SetWaitableTimer = {((04 52 5b fb) | (fb 5b 52 04))}
		$SendMessageA = {((95 64 44 75) | (75 44 64 95))}
		$RegUnLoadKeyA = {((a4 44 43 10) | (10 43 44 a4))}
		$SetEnvironmentVariableA = {((ea 0c 08 0d) | (0d 08 0c ea))}
		$VirtualAlloc2 = {((3d ae 02 a9) | (a9 02 ae 3d))}
		$CryptProtectData = {((e6 32 77 52) | (52 77 32 e6))}
		$GetDesktopWindow = {((1c 27 d8 f7) | (f7 d8 27 1c))}
		$RegGetKeySecurity = {((91 fb e7 04) | (04 e7 fb 91))}
		$GetDC = {((0d 3d 24 ac) | (ac 24 3d 0d))}
		$LookupPrivilegeValueA = {((bb ae 6e 84) | (84 6e ae bb))}
		$CryptGetHashParam = {((40 86 fd 4c) | (4c fd 86 40))}
		$HeapAlloc = {((1f fd 67 0e) | (0e 67 fd 1f))}
		$RegCloseKey = {((73 6b 37 02) | (02 37 6b 73))}
		$CryptHashData = {((46 25 d4 95) | (95 d4 25 46))}
		$GlobalAlloc = {((bb 51 39 41) | (41 39 51 bb))}
		$RegOverridePredefKey = {((63 05 03 a2) | (a2 03 05 63))}
		$EnumSystemLocalesA = {((86 3e ce 83) | (83 ce 3e 86))}
		$GetProcessId = {((49 86 c7 f1) | (f1 c7 86 49))}
		$RegLoadMUIStringA = {((f8 b5 a2 e6) | (e6 a2 b5 f8))}
		$SearchPathA = {((d6 58 3f c9) | (c9 3f 58 d6))}
		$FindClose = {((b4 e7 45 1c) | (1c 45 e7 b4))}
		$NtDeleteValueKey = {((1b 63 a2 00) | (00 a2 63 1b))}
		$URLDownloadToFile = {((6b 16 9b 53) | (53 9b 16 6b))}
		$Toolhelp32ReadProcessMemory = {((29 5d 19 c5) | (c5 19 5d 29))}
		$GetProcAddress = {((cf 31 bb 1f) | (1f bb 31 cf))}
		$OpenProcessToken = {((c5 7b d0 97) | (97 d0 7b c5))}
		$HeapCreate = {((24 bd 1d 77) | (77 1d bd 24))}
		$UuidFromStringA = {((fb 4f a7 c8) | (c8 a7 4f fb))}
		$VirtualProtectEx = {((d8 12 92 2a) | (2a 92 12 d8))}
		$GetSystemTimeAsFileTime = {((4b bf 08 3c) | (3c 08 bf 4b))}
		$GetModuleBaseNameA = {((fa 8f df 88) | (88 df 8f fa))}
		$lstrcatA = {((d2 bf ab 63) | (63 ab bf d2))}
		$SetFileAttributesA = {((f5 a6 06 59) | (59 06 a6 f5))}
		$FindResourceA = {((3c 70 4e 2f) | (2f 4e 70 3c))}
		$WaitForMultipleObjects = {((6d a0 77 f7) | (f7 77 a0 6d))}
		$QueryPerformanceCounter = {((db 4e 15 0d) | (0d 15 4e db))}
		$NtCreateThreadEx = {((cb 0c 21 30) | (30 21 0c cb))}
		$NtContinue = {((78 0a 61 2c) | (2c 61 0a 78))}
		$IsWoW64Process = {((1e b5 21 47) | (47 21 b5 1e))}
		$DnsQuery_A = {((eb 04 a3 80) | (80 a3 04 eb))}
		$VirtualProtectFromApp = {((ed 87 4e 02) | (02 4e 87 ed))}
		$GetAsyncKeyState = {((11 24 46 0d) | (0d 46 24 11))}
		$EncryptFileA = {((b3 ed ff 4b) | (4b ff ed b3))}
		$DuplicateToken = {((ca 0c 21 81) | (81 21 0c ca))}
		$CryptDeriveKey = {((a2 db 2f df) | (df 2f db a2))}
		$LockResource = {((14 5a 92 96) | (96 92 5a 14))}
		$ResumeThread = {((74 16 2a 6e) | (6e 2a 16 74))}
		$WaitForSingleObjectEx = {((56 bd 01 97) | (97 01 bd 56))}
		$NtSuspendProcess = {((54 09 bd e8) | (e8 bd 09 54))}
		$NetShareCheck = {((b8 e2 13 fd) | (fd 13 e2 b8))}
		$OpenThread = {((80 6c b7 8f) | (8f b7 6c 80))}
		$URLOpenStream = {((56 46 0b 16) | (16 0b 46 56))}
		$UnmapViewOfFile = {((d6 39 f2 56) | (56 f2 39 d6))}
		$CreateFile2 = {((eb 96 c5 eb) | (eb c5 96 eb))}
		$DeleteService = {((94 ed c1 69) | (69 c1 ed 94))}
		$GetThreadId = {((25 37 b2 2a) | (2a b2 37 25))}
		$RegDeleteKeyA = {((fa 08 ff e0) | (e0 ff 08 fa))}
		$CreateTimerQueueTimer = {((11 72 96 a0) | (a0 96 72 11))}
		$SetProcessDEPPolicy = {((65 f5 70 f9) | (f9 70 f5 65))}
		$CreateServiceA = {((93 1e ce 0b) | (0b ce 1e 93))}
		$ExitWindowsEx = {((cd ad 4a 07) | (07 4a ad cd))}
		$NtMapViewOfSection = {((23 1f 19 6a) | (6a 19 1f 23))}
		$NtTerminateThread = {((ac 3c 9d c8) | (c8 9d 3c ac))}
		$Process32First = {((92 78 b8 71) | (71 b8 78 92))}
		$RegCreateKeyTransactedA = {((66 94 c2 ca) | (ca c2 94 66))}
		$GetUserNameA = {((9b c3 ab 46) | (46 ab c3 9b))}
		$MapVirtualKeyA = {((d7 5b 53 d4) | (d4 53 5b d7))}
		$WNetCloseEnum = {((5f 2f a7 ce) | (ce a7 2f 5f))}
		$InternetReadFileExA = {((bb 2b 3b a8) | (a8 3b 2b bb))}
		$GetComputerNameA = {((aa 63 bf b6) | (b6 bf 63 aa))}
		$RegFlushKey = {((46 31 4e 8e) | (8e 4e 31 46))}
		$VirtualAllocEx = {((f3 6e 5a b4) | (b4 5a 6e f3))}
		$GetSystemDefaultLangId = {((30 1a 43 1e) | (1e 43 1a 30))}
		$SetFileTime = {((b8 ea ce e0) | (e0 ce ea b8))}
		$SendNotifyMessageA = {((0d c2 7d ee) | (ee 7d c2 0d))}
		$LookupAccountNameA = {((46 24 80 6e) | (6e 80 24 46))}
		$NetShareEnum = {((b0 46 1d b4) | (b4 1d 46 b0))}
		$IcmpSendEcho = {((8f b6 46 97) | (97 46 b6 8f))}
		$DebugActiveProcessStop = {((82 77 bf 8d) | (8d bf 77 82))}
		$NtCreateFile = {((15 a5 ec db) | (db ec a5 15))}
		$DecryptFileA = {((d2 b8 42 a1) | (a1 42 b8 d2))}
		$GetRawInputData = {((d2 df a3 19) | (19 a3 df d2))}
		$BringWindowToTop = {((81 b1 da 65) | (65 da b1 81))}
		$NetShareSetInfo = {((43 5c a1 77) | (77 a1 5c 43))}
		$GetLogicalDrives = {((30 bc 77 0d) | (0d 77 bc 30))}
		$WriteFile = {((66 3c ec b0) | (b0 ec 3c 66))}
		$BitBlt = {((a9 80 4e 46) | (46 4e 80 a9))}
		$SendMessageTimeoutA = {((b4 b0 9d 1c) | (1c 9d b0 b4))}
		$GetCurrentProcess = {((ca 8d 75 27) | (27 75 8d ca))}
		$RegDeleteTreeA = {((3b d2 a9 27) | (27 a9 d2 3b))}
		$CreateProcessWithTokenW = {((94 e7 6e 4c) | (4c 6e e7 94))}
		$FindWindowA = {((88 40 29 3f) | (3f 29 40 88))}
		$CopyFileA = {((ac 22 53 c1) | (c1 53 22 ac))}
		$FtpPutFileA = {((44 b3 5e 49) | (49 5e b3 44))}
		$NtOpenProcess = {((50 03 c0 58) | (58 c0 03 50))}
		$Send = {((7c 8c 4f 2f) | (2f 4f 8c 7c))}
		$EnumDeviceDrivers = {((71 48 1c e9) | (e9 1c 48 71))}
		$Process32Next = {((90 17 7f 28) | (28 7f 17 90))}
		$GetWindowDC = {((2d 98 af e4) | (e4 af 98 2d))}
		$CryptDecrypt = {((de 32 a4 52) | (52 a4 32 de))}
		$ReadFile = {((71 01 99 21) | (21 99 01 71))}
		$VirtualProtect = {((84 4f f1 8d) | (8d f1 4f 84))}
		$OpenProcess = {((71 36 fd d6) | (d6 fd 36 71))}
		$WaitForMultipleObjectsEx = {((57 9e 5b 14) | (14 5b 9e 57))}
		$Inet_addr = {((22 20 9d 0f) | (0f 9d 20 22))}
		$WSAStartup = {((61 28 c6 83) | (83 c6 28 61))}
		$Bind = {((7c 83 0d c2) | (c2 0d 83 7c))}
		$GetTempFileNameA = {((79 09 6f bd) | (bd 6f 09 79))}
		$CreateMutexExA = {((dc b6 0a 0a) | (0a 0a b6 dc))}
		$DeviceIoControl = {((05 94 40 ce) | (ce 40 94 05))}
		$CryptDestroyHash = {((48 52 06 e5) | (e5 06 52 48))}
		$CryptEncrypt = {((40 2b 4e bc) | (bc 4e 2b 40))}
		$NtSetContextThread = {((30 8b e0 d0) | (d0 e0 8b 30))}
		$CryptReleaseContext = {((10 d3 32 fd) | (fd 32 d3 10))}
		$StretchBlt = {((f7 58 f7 24) | (24 f7 58 f7))}
		$NtWaitForSingleObject = {((4c 6d c6 3c) | (3c c6 6d 4c))}
		$LoadLibraryExA = {((4f 80 3c 78) | (78 3c 80 4f))}
		$PeekMessageA = {((0d 92 29 30) | (30 29 92 0d))}
		$WNetAddConnectionA = {((87 15 f0 dd) | (dd f0 15 87))}
		$NtCreateThread = {((37 6e 07 13) | (13 07 6e 37))}
		$ShellExecuteExA = {((9a ef a2 ee) | (ee a2 ef 9a))}
		$GetMessageA = {((cb ce b9 ab) | (ab b9 ce cb))}
		$GetCurrentHwProfileA = {((3e d9 e0 79) | (79 e0 d9 3e))}
		$PostThreadMessageA = {((8f a7 f1 c9) | (c9 f1 a7 8f))}
		$RegOpenKeyExA = {((07 4a 97 5c) | (5c 97 4a 07))}
		$CreateWaitableTimer = {((7c 66 fa 23) | (23 fa 66 7c))}
		$NtSetInformationProcess = {((bb 7a 48 b8) | (b8 48 7a bb))}
		$InternetSetOptionA = {((ac 92 8e f4) | (f4 8e 92 ac))}
		$GetClipboardData = {((8d 26 57 2f) | (2f 57 26 8d))}
		$HttpSendRequestExA = {((29 ed 88 b6) | (b6 88 ed 29))}
		$CreateProcessA = {((ae b5 2e 19) | (19 2e b5 ae))}
		$CreateToolhelp32Snapshot = {((66 85 12 95) | (95 12 85 66))}
		$GetProcessHeap = {((c6 58 0d 02) | (02 0d 58 c6))}
		$MapVirtualKeyExA = {((1b 7f b9 91) | (91 b9 7f 1b))}
		$NtTerminateProcess = {((17 03 ab 2f) | (2f ab 03 17))}
		$CallNextHookEx = {((0b 9a 5f 4e) | (4e 5f 9a 0b))}
		$TerminateProcess = {((60 af 07 6d) | (6d 07 af 60))}
		$GetIpNetTable = {((bb 57 eb 6d) | (6d eb 57 bb))}
		$SetThreadToken = {((57 5b 17 ca) | (ca 17 5b 57))}
		$SetCurrentDirectory = {((15 4b bf 09) | (09 bf 4b 15))}
		$GetFileTime = {((78 92 4f d4) | (d4 4f 92 78))}
		$CreateRemoteThread = {((aa 30 77 5d) | (5d 77 30 aa))}
		$KeInsertQueueApc = {((cf f9 93 43) | (43 93 f9 cf))}
		$SetWindowsHookExA = {((6c 2f 07 8b) | (8b 07 2f 6c))}
		$EnumWindows = {((94 cf dc c5) | (c5 dc cf 94))}
		$NtSetSystemEnvironmentValueEx = {((a6 5d e6 07) | (07 e6 5d a6))}
		$GetKeynameTextA = {((61 f2 bc 35) | (35 bc f2 61))}
		$CryptCreateHash = {((78 b2 9a 6f) | (6f 9a b2 78))}
		$CreateThread = {((7f 08 f4 51) | (51 f4 08 7f))}
		$GetCurrentThread = {((e0 39 08 c0) | (c0 08 39 e0))}
		$EnumResourceTypesExA = {((99 92 8f 35) | (35 8f 92 99))}
		$OpenSCManagerA = {((ba ef 47 89) | (89 47 ef ba))}
		$NtWriteVirtualMemory = {((95 f3 a7 92) | (92 a7 f3 95))}
		$WSASocketA = {((55 9f 15 9a) | (9a 15 9f 55))}
		$SetWindowLongPtrA = {((25 52 e6 f0) | (f0 e6 52 25))}
		$CryptAcquireContextA = {((9f e6 f4 47) | (47 f4 e6 9f))}
		$Thread32Next = {((69 52 09 e1) | (e1 09 52 69))}
		$RegisterRawInputDevices = {((fb 1c 93 07) | (07 93 1c fb))}
		$Gethostbyname = {((44 f8 2d 5f) | (5f 2d f8 44))}
		$GetLogicalProcessorInformationEx = {((df cb 5b c3) | (c3 5b cb df))}
		$CreateWindowExA = {((1c 82 e2 6f) | (6f e2 82 1c))}
		$GetTickCount64 = {((61 4d b0 23) | (23 b0 4d 61))}
		$SendMessageCallbackA = {((ee d5 7f 62) | (62 7f d5 ee))}
		$WNetAddConnection2A = {((69 d4 0a cf) | (cf 0a d4 69))}
		$ShellExecuteA = {((38 17 41 f1) | (f1 41 17 38))}
		$CryptGenRandom = {((95 4a 41 d2) | (d2 41 4a 95))}
		$RegConnectRegistryA = {((9f b7 ec 27) | (27 ec b7 9f))}
		$CryptBinaryToString = {((30 1c 54 76) | (76 54 1c 30))}
		$RtlMoveMemory = {((04 02 76 07) | (07 76 02 04))}
		$CopyFile2 = {((ac 22 53 b2) | (b2 53 22 ac))}
		$TimeGetTime = {((72 82 ba 63) | (63 ba 82 72))}
		$Thread32First = {((93 04 9a 4a) | (4a 9a 04 93))}
		$PostMessageA = {((94 25 26 91) | (91 26 25 94))}
		$WSACleanup = {((7f 1a ab 78) | (78 ab 1a 7f))}
		$NtShutdownSystem = {((7a a5 aa e8) | (e8 aa a5 7a))}
		$GetModuleFileNameA = {((13 b8 a1 4d) | (4d a1 b8 13))}
		$Socket = {((d1 8b ef 0e) | (0e ef 8b d1))}
		$NtCreateUserProcess = {((5f 8e 45 59) | (59 45 8e 5f))}
		$GetCurrentProcessId = {((a3 bf 64 b4) | (b4 64 bf a3))}
		$InternetCloseHandle = {((42 41 be f0) | (f0 be 41 42))}
		$OpenFileMappingA = {((73 c4 b6 44) | (44 b6 c4 73))}
		$NtQueryDirectoryFile = {((a9 05 3f 72) | (72 3f 05 a9))}
		$GetAdaptersInfo = {((bc 95 0f c5) | (c5 0f 95 bc))}
		$MapViewOfFile = {((11 de b0 b3) | (b3 b0 de 11))}
		$TerminateThread = {((87 ae 6a 46) | (46 6a ae 87))}
		$ControlServiceExA = {((f9 60 93 f5) | (f5 93 60 f9))}
		$CreateProcessInternal = {((e3 52 71 d5) | (d5 71 52 e3))}
		$CreateMutexA = {((6f a1 32 0d) | (0d 32 a1 6f))}
		$WSAIoctl = {((58 3b 35 4b) | (4b 35 3b 58))}
		$RegOpenKeyTransactedA = {((3e 9f 84 88) | (88 84 9f 3e))}
		$Connect = {((34 2e b5 af) | (af b5 2e 34))}
		$RegQueryInfoKeyA = {((46 79 d7 0f) | (0f d7 79 46))}
		$RegSetKeySecurity = {((58 fe 9a 90) | (90 9a fe 58))}
		$NtClose = {((8b 8e 13 3d) | (3d 13 8e 8b))}
		$Sleep = {((0e 19 e5 fe) | (fe e5 19 0e))}
		$NtProtectVirtualMemory = {((08 29 62 c8) | (c8 62 29 08))}
		$NtReadVirtualMemory = {((c2 40 62 e3) | (e3 62 40 c2))}
		$Gethostname = {((b8 9f ae 04) | (04 ae 9f b8))}
		$CopyFileExA = {((3e 06 68 be) | (be 68 06 3e))}
		$Wow64SetThreadContext = {((72 aa a2 b5) | (b5 a2 aa 72))}
		$EnumProcessModulesEx = {((98 04 d5 6f) | (6f d5 04 98))}
		$GetSystemDirectoryA = {((e6 43 c4 60) | (60 c4 43 e6))}
		$NtCreateProcess = {((08 62 3d da) | (da 3d 62 08))}
		$SetThreadContext = {((7e 20 96 4e) | (4e 96 20 7e))}
		$DnsQueryEx = {((eb 04 a0 5d) | (5d a0 04 eb))}
		$LoadResource = {((dc de 59 4d) | (4d 59 de dc))}
		$NtAllocateVirtualMemory = {((67 93 c3 4c) | (4c c3 93 67))}
		$ConnectNamedPipe = {((c0 03 c6 02) | (02 c6 03 c0))}
		$RegDeleteKeyValueA = {((95 18 c1 dd) | (dd c1 18 95))}
		$CreatePipe = {((9a 8d ee e7) | (e7 ee 8d 9a))}
		$NtDelayExecution = {((0a 49 08 4a) | (4a 08 49 0a))}
		$RtlGetVersion = {((3c a3 aa 1d) | (1d aa a3 3c))}
		$NtOpenThread = {((fb 8a 31 d1) | (d1 31 8a fb))}
		$RegReplaceKeyA = {((14 84 95 a9) | (a9 95 84 14))}
		$RtlCreateHeap = {((af aa c1 89) | (89 c1 aa af))}
		$CheckRemoteDebuggerPresent = {((06 63 8c 15) | (15 8c 63 06))}
		$GetProcessIdOfThread = {((34 14 96 3e) | (3e 96 14 34))}
		$SetForegroundWindow = {((54 bc 34 84) | (84 34 bc 54))}
		$SetWinEventHook = {((a6 8a c1 b2) | (b2 c1 8a a6))}
		$RegisterHotKey = {((82 ff 7f 9e) | (9e 7f ff 82))}
		$NtQueryInformationProcess = {((d0 34 fc 62) | (62 fc 34 d0))}
		$CreateRemoteThreadEx = {((f8 2b cb fa) | (fa cb 2b f8))}
		$OpenClipboard = {((77 4d fc 27) | (27 fc 4d 77))}
		$RegEnumValueA = {((86 65 21 16) | (16 21 65 86))}
		$URLDownloadToCacheFile = {((b4 06 de a7) | (a7 de 06 b4))}
		$LocalAlloc = {((73 ce bc 5b) | (5b bc ce 73))}
		$ShowWindow = {((e3 21 46 1e) | (1e 46 21 e3))}
		$VirtualQueryEx = {((d7 93 eb 9f) | (9f eb 93 d7))}
		$NtQueueApcThread = {((d4 61 22 38) | (38 22 61 d4))}
		$NtMakeTemporaryObject = {((71 1c 12 9f) | (9f 12 1c 71))}
		$VirtualAllocExNuma = {((63 f1 5a 65) | (65 5a f1 63))}
		$RegOpenKeyA = {((a2 ae 42 df) | (df 42 ae a2))}
		$EnumDesktopWindows = {((60 15 eb bf) | (bf eb 15 60))}
		$WaitForSingleObject = {((ec cd a1 ba) | (ba a1 cd ec))}
		$FindResourceExA = {((19 bc b6 ac) | (ac b6 bc 19))}
		$CryptStringToBinary = {((0d cd 66 76) | (76 66 cd 0d))}
		$RegEnumKeyA = {((f3 67 ea 22) | (22 ea 67 f3))}
		$Select = {((d0 db cf a5) | (a5 cf db d0))}
		$WNetEnumResourceA = {((9a 7f f4 01) | (01 f4 7f 9a))}
		$EnumProcesses = {((71 11 81 f1) | (f1 81 11 71))}
		$Listen = {((c0 d4 2b f4) | (f4 2b d4 c0))}
		$RegCreateKeyA = {((36 9a 66 a1) | (a1 66 9a 36))}
		$IsDebuggerPresent = {((e6 a2 48 47) | (47 48 a2 e6))}
		$FindNextUrlCacheEntryA = {((0f cc 64 ff) | (ff 64 cc 0f))}
		$StartServiceA = {((7e da e3 25) | (25 e3 da 7e))}
		$GetThreadContext = {((eb a2 cf c2) | (c2 cf a2 eb))}
		$VirtualAlloc = {((38 2c 0f 97) | (97 0f 2c 38))}
		$Module32First = {((a1 44 bd d8) | (d8 bd 44 a1))}
		$FindFirstUrlCacheEntryA = {((94 bf 49 a8) | (a8 49 bf 94))}
		$SleepEx = {((fc 2b 66 db) | (db 66 2b fc))}
		$MoveFileA = {((d8 34 fd bd) | (bd fd 34 d8))}
		$NtSetValueKey = {((f5 2d 53 59) | (59 53 2d f5))}
		$SetWindowLongA = {((8e b8 cf 1a) | (1a cf b8 8e))}
		$MapViewOfFileEx = {((04 4d b2 d0) | (d0 b2 4d 04))}
		$NtDuplicateObject = {((23 88 ee 19) | (19 ee 88 23))}
		$GetKeyboardState = {((c8 43 14 37) | (37 14 43 c8))}
		$GetSystemTime = {((83 0e e3 b9) | (b9 e3 0e 83))}
		$FindWindowExA = {((98 ef 95 bc) | (bc 95 ef 98))}
		$RegQueryMultipleValuesA = {((25 52 7c 76) | (76 7c 52 25))}
		$DrawTextExA = {((50 f0 98 56) | (56 98 f0 50))}
		$RegEnumKeyExA = {((6d 0b 1b 5f) | (5f 1b 0b 6d))}
		$QueueUserAPC = {((76 c0 c4 bd) | (bd c4 c0 76))}
		$RegSaveKeyA = {((f8 10 dd 3c) | (3c dd 10 f8))}
		$CreateFileMappingA = {((f3 3f fc 86) | (86 fc 3f f3))}
		$CryptDestroyKey = {((30 bc b8 2a) | (2a b8 bc 30))}
		$RegDeleteKeyExA = {((a0 48 98 9d) | (9d 98 48 a0))}
		$EnumResourceTypesA = {((1a b4 70 78) | (78 70 b4 1a))}
		$RegSetKeyValueA = {((0f 47 6b d6) | (d6 6b 47 0f))}
		$timeSetEvent = {((f3 53 3e 62) | (62 3e 53 f3))}
		$RegSaveKeyExA = {((3f bd 3c f9) | (f9 3c bd 3f))}
		$CountClipboardFormats = {((3b 08 8a 9a) | (9a 8a 08 3b))}
		$HttpAddRequestHeaders = {((3c 56 2c 93) | (93 2c 56 3c))}
		$NtQueueApcThreadEx2 = {((97 85 cc 67) | (67 cc 85 97))}
		$RegCopyTreeA = {((ff 72 86 4f) | (4f 86 72 ff))}
		$ImpersonateLoggedOnUser = {((a6 ff d5 5a) | (5a d5 ff a6))}
		$GetDriveTypeA = {((74 bb 76 82) | (82 76 bb 74))}
		$GetVersionExA = {((45 c0 2e e9) | (e9 2e c0 45))}
		$InternetReadFile = {((fb 4f 8e aa) | (aa 8e 4f fb))}
		$RegOpenCurrentUser = {((5f d3 9c b7) | (b7 9c d3 5f))}
		$GetThreadLocale = {((88 b7 33 0d) | (0d 33 b7 88))}
		$NtUnmapViewOfSection = {((59 50 14 ad) | (ad 14 50 59))}
		$FindNextFileA = {((f3 b4 3c 46) | (46 3c b4 f3))}
		$GetLogicalProcessorInformation = {((47 e7 80 e6) | (e6 80 e7 47))}
		$FlushEfsCache = {((48 f6 67 99) | (99 67 f6 48))}
		$Closesocket = {((9d b6 08 e4) | (e4 08 b6 9d))}
		$NetShareGetInfo = {((a7 a1 c8 6b) | (6b c8 a1 a7))}
		$GetModuleHandleA = {((5a 15 3f 58) | (58 3f 15 5a))}
		$VirtualAlloc2FromApp = {((e7 7b 87 9e) | (9e 87 7b e7))}
		$MoveFileExA = {((b9 6b 81 ba) | (ba 81 6b b9))}
		$NtWaitForMultipleObjects = {((3d 45 65 39) | (39 65 45 3d))}
		$DeleteFileA = {((1c d8 87 19) | (19 87 d8 1c))}
		$StartServiceCtrlDispatcherA = {((88 f0 d6 61) | (61 d6 f0 88))}
		$HttpOpenRequestA = {((f0 fc b9 e1) | (e1 b9 fc f0))}
		$GetThreadInformation = {((45 13 cd 63) | (63 cd 13 45))}
		$NtDeleteKey = {((f7 10 37 e3) | (e3 37 10 f7))}
		$InternetWriteFile = {((3a 49 93 59) | (59 93 49 3a))}
		$LoadLibraryA = {((5f bf f0 fb) | (fb f0 bf 5f))}
		$RegQueryValueExA = {((6b 95 d1 14) | (14 d1 95 6b))}
		$NtCreateProcessEx = {((a9 e9 25 b7) | (b7 25 e9 a9))}
		$GetForegroundWindow = {((0a 7f 69 78) | (78 69 7f 0a))}
		$NtQuerySystemEnvironmentValueEx = {((f5 3f 31 31) | (31 31 3f f5))}
		$SizeOfResource = {((8a c5 84 3d) | (3d 84 c5 8a))}
		$RegGetValueA = {((79 fe 96 e1) | (e1 96 fe 79))}
		$LdrLoadDll = {((03 07 db 23) | (23 db 07 03))}
		$NtResumeThread = {((2c 7b 3d 30) | (30 3d 7b 2c))}
		$MapViewOfFile3 = {((4d b4 c7 46) | (46 c7 b4 4d))}
		$NtQueryTimer = {((d2 d6 a4 7e) | (7e a4 d6 d2))}
		$RtlCopyMemory = {((55 9a 8c 8b) | (8b 8c 9a 55))}
		$InternetConnectA = {((44 53 61 59) | (59 61 53 44))}
		$SetClipboardData = {((1f a4 1d bb) | (bb 1d a4 1f))}
		$GetKeyState = {((ff 11 47 4f) | (4f 47 11 ff))}
		$WriteProcessMemory = {((6f 22 e8 c8) | (c8 e8 22 6f))}
		$RtlSetProcessIsCritical = {((27 e5 6a c9) | (c9 6a e5 27))}
		$NetShareAdd = {((b7 c3 fe 08) | (08 fe c3 b7))}
		$NtResumeProcess = {((9f 16 37 97) | (97 37 16 9f))}
		$GetProcessHeaps = {((91 59 ad b5) | (b5 ad 59 91))}
		$RegDeleteKeyTransactedA = {((05 a7 36 c9) | (c9 36 a7 05))}
		$ReadProcessMemory = {((b8 93 24 59) | (59 24 93 b8))}
		$GetNativeSystemInfo = {((39 5d c8 9d) | (9d c8 5d 39))}
		$ioctlsocket = {((06 dc d6 09) | (09 d6 dc 06))}
		$CreateProcessAsUserA = {((b0 53 cc 2c) | (2c cc 53 b0))}
		$PeekNamedPipe = {((94 f0 8b 9d) | (9d 8b f0 94))}
		$SuspendThread = {((8b f7 52 5f) | (5f 52 f7 8b))}
		$CallWindowProcA = {((b8 f5 4a 6e) | (6e 4a f5 b8))}
		$OpenServiceA = {((7c 80 58 c9) | (c9 58 80 7c))}
		$SetTimer = {((88 87 2b 52) | (52 2b 87 88))}
		$MapViewOfFile2 = {((4d b4 c7 45) | (45 c7 b4 4d))}
		$RegRestoreKeyA = {((2c b5 43 b1) | (b1 43 b5 2c))}
		$InternetOpenUrlA = {((8f 5c a3 b4) | (b4 a3 5c 8f))}
		$GetTempPathA = {((9e f9 79 e9) | (e9 79 f9 9e))}
		$NtAdjustPrivilegesToken = {((69 21 f9 cd) | (cd f9 21 69))}
		$GetTickCount = {((41 ad 16 b9) | (b9 16 ad 41))}
		$RegSetValueExA = {((34 58 72 ea) | (ea 72 58 34))}
		$NtCreateSection = {((d0 2e 20 d0) | (d0 20 2e d0))}
		$SetPropA = {((88 43 c2 73) | (73 c2 43 88))}
		$GetModuleFileNameExA = {((e4 66 49 4a) | (4a 49 66 e4))}
		$PathFileExistsA = {((45 ed d6 93) | (93 d6 ed 45))}
		$SetFocus = {((87 8c f6 11) | (11 f6 8c 87))}
		$GetDCEx = {((51 19 09 09) | (09 09 19 51))}
		$WNetOpenEnumA = {((76 6f a4 ab) | (ab a4 6f 76))}
		$FindFirstFileA = {((ae 26 36 cf) | (cf 36 26 ae))}
		$AttachThreadInput = {((e2 8a f6 02) | (02 f6 8a e2))}
		$AdjustTokenPrivileges = {((ce 4c d9 cb) | (cb d9 4c ce))}
		$EnumProcessModules = {((a5 de 9f 92) | (92 9f de a5))}

	condition:
		pe.is_pe and for any i in ( 0 .. pe.number_of_sections - 1 ) : ( ( pe.sections [ i ] . characteristics & pe.SECTION_MEM_EXECUTE != 0 or pe.sections [ i ] . characteristics & pe.SECTION_CNT_CODE != 0 ) and ( math.entropy ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) <= 7 ) and ( for 10 of them : ( $ in ( pe.sections [ i ] . raw_data_offset .. pe.sections [ i ] . raw_data_offset + pe.sections [ i ] . raw_data_size ) ) ) )
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e953522c-4606-4831-9aec-c30ad170e3e2
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
