_Virus_Hijack_Gen_Trojan_ShellObject_j8X_aOWk52b_4_1_Virus_Hijac_45

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0V9N8g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0V9N8g_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@amWqEpo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@aO3hPGn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.jSZ@a8YIsUn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.jzZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_20.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_j8X_aOWk52b_4_1_Virus_Hijac_45 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8X@aOWk52b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0q1@io_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0V9N8g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@a0V9N8g_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@aCkwazk_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ae0D4Vj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@amWqEpo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@aO3hPGn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.jSZ@a8YIsUn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@aKo42Jj_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.juZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.jzZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@aSzGK!f_20.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "d1fc4b6e1cd7884db61a673aaf27523cd524c9724bbdd3cc53c4e2b0f8c4d71e"
    hash2       = "f3332f79ee7edda7918a608e8744eace05f0aae5e5ff47c549bde66188c58aa2"
    hash3       = "004794e402932e0fd28ea3a9afa51cc1a7f9d11987bd80e3d0b978657936452d"
    hash4       = "1be6748eddf875f17d4518b4973762eb006121cb3386d3a3bfd1f1c24e90ad85"
    hash5       = "f7c26f1972f6bece87c989002dd0520547791d0669749d005ad24855d9a40ebf"
    hash6       = "6389ea94a79de7bf09c128d9fb8e69276bb611e636bd9bce7ace82e43ec2e369"
    hash7       = "1fbbc4cfa1d1203aba67e2f7644a8e702f606aff3370c26c465046b8f1359719"
    hash8       = "f713cfd42e70f229a2179b20aafacf23a201b65c30553858b0c47e2e3c82e418"
    hash9       = "c37fd77fe23ffeb45b9b968b77e720e359f5c2a662066bb83a63717217138db7"
    hash10      = "fa01c77abff84b8a03e7ab61169b8a3fefa8fde0bb0ee1bddd3147ec02c2c17d"
    hash11      = "608443ad35cfda5ca4ebfa1409b44a6aeefe74a3953e8140511f1f5c08c8052d"
    hash12      = "5e96bb41eb9aa409f37d7897f480701db8109a5075924c517a1a6637e8155d22"
    hash13      = "d27f8c44bf5a82d98356fba379662d35b57cac933d9601f40e7a6854b1a2f9f5"
    hash14      = "fad21a31419f2bc6b2df5e1412ea6fc20ae9610031d1f6621cc782f492eb8967"
    hash15      = "eb49a6cba72b1b600170bb9c870cbabcd975765064ec7e14d19d17d2311734ef"
    hash16      = "e6e11378cd641ce0ec075db2564b4a158c34e36b8beb11c0d38d236f5744b016"
    hash17      = "2b234c64c132eda3af390625929cbca1d17fcb0c189decf98fbd5204205fa0f2"
    hash18      = "c2b1540bfb391b4caaf378def9b391e1e5b72508c60024a14d038258f79c3436"
    hash19      = "69c72415fa806454ce8a3f29ca16292789c3f7ea7b68fe0610e08979119a43be"
    hash20      = "a41013aa5b103e8db7d3afb55358ba2a822358a32fa2c35cda53e577b7cf875f"
    hash21      = "7d624d81fddd3c30a6c156bf798eb31fc3c68868b83f71f3ffc4ab6e964e8f09"
    hash22      = "7f111c8a7c0ebd8a6239aa9825842d8f9d058ff2524f3679dfe9cd1f93604725"
    hash23      = "a21146842a0f63b5eb7a548542eaf1660e0cd246dfce90b0565830da91521b57"
    hash24      = "2147d46886e812c36139da3e1b00722cd2261a4e7c7fa2861dea74bed7628d19"
    hash25      = "73bb3022992da1cdaea3b45fd7de67da12bcd95e7078a8eeb2c2feb8f3516020"
    hash26      = "879ddfcf155046c7110f7cca2a6b1268e7ded170978f55da6141d056c5fe3986"
    hash27      = "6586186b6b9360c5dc4fe65a800abf7d58b0eb2a06ae22ce5eaea313609ce6f7"
    hash28      = "71a398c306c255f9b285a0d5f192fcfa060fd5414c94c544fe5795b1140e0c38"
    hash29      = "6396b1bcde24d8d851dd51728abf7b1e8e88e5b19d917900f911ad6dc55bb87f"
    hash30      = "177e81da942333056d979eb2064f5136af354653e205f930c35bb5343c572b93"
    hash31      = "335b93f2c6c45aee0702f04e2039de965f7403841ebcfceffe5ccc2bab66cc5b"
    hash32      = "8841632d649ce7a2d74544a90adb5610eab42324f45eb63c3655e438d6bf8111"
    hash33      = "338c51d1626cec578cea2269af6538ab60028371c834754542c083999317614e"
    hash34      = "c561d7fdf613a16095cb5e321671b551a602dfe72a91d655d227d63e9de9c5a2"
    hash35      = "0691382a2170a87fc1969b83df550a67adbe560e5885dace85bf26027f24af1d"
    hash36      = "a836fb0b9eeee2f29cc4fbce3abc7464ef637d8dc1624d5add3b150ce0a3b2b8"
    hash37      = "7e6c590c53b8a4bd98ae6328866a34df7beef2883d13ea466389dc64372caee2"
    hash38      = "3244e6e58b7af5c2293bb50633359fb6ec98074c4e29624cbd4b2540a038978b"
    hash39      = "f395ccdcb445a9da63fd07970e575cebbc73bb51d8f95d6e0957f219e6521b71"
    hash40      = "ca19fc56501a752b6d06ff38e66a7f9c98984ee7cf7599e6140dfbf419f07a10"
    hash41      = "7f86edae230ee032f8ba3f9959407c62502fe321e40a0e641a9c32211e20778d"
    hash42      = "a7ece6d86ee4101e7b8238f2fc20e9c21ad40f04f95432825aeef1b434c96bc7"
    hash43      = "5f3d66a0b06031aef0eb9323147d88b13bcd414d1015d7e2ab922136aff36348"
    hash44      = "2cb2455895375f1f913e07c44f861853eb5f03352c71e230502f61057788e37c"
    hash45      = "9bc7a09197b831cabb805ccf254287fa1dcf4f8d342d334ce6271028b0e3c645"
    hash46      = "409c2d9aa53c4ed61ccf1830b0f5852e527142aaf0db3c84a22463b8015dbe47"
    hash47      = "9f3a6c8a11ae21ac5fb58a0aee5dc18027ec7f02ab0ae7bb935cef2488b0d575"
    hash48      = "ed8ca9c5a99f3188e808ae63ec0e51bb70d937953a623bb6ef37c6587f96b1bf"
    hash49      = "b4c640d0b791ca90e10a1083a50d1cc642f86844c5b3e279eca9d095a58accc1"
    hash50      = "9da04220ddb4b8ca65e041cc785e93f82d18879caed1eac8a079182898acb2aa"
    hash51      = "cab5e2072573443e8e4047c7afb3856f501c62d8bc6578da915c2a4338cfa724"
    hash52      = "d7ad96ddac391bb7a5739200921b1cb8ab4a4d30ae5ccc69a21e62c304dddb67"
    hash53      = "289541e180ec17fdd737147f13b2cb5ed8772f008ec24f64cf99061596686414"
    hash54      = "4b9d738f062ba82dbfd1b5fefc90560baa07a002621aeb38df63159a709aad20"
    hash55      = "d410c2697172cb9048cf9f1083ea2e2cbe21ba7298c9a73c6207757058399441"
    hash56      = "ed01d6524a1ab3c38528f74bed5668002e96f5c2cba7dbadbd6a84ddcad37534"
    hash57      = "2290ae66346bbd110770fd7479e04d403e54bdc60c83c5eaa5ae002e87c5d132"
    hash58      = "79f9609b8eed0a77a76805747c4cef0af604d74656d354898f622428e52ceecc"
    hash59      = "316e90d540f3ff328264e982cd23513288d1b13a2615b56b7ff2b06b1ffa0596"
    hash60      = "42ed38ad7023327d24d68bf10ff1fad5841c8b95512bbb367d67be7b7769b914"
    hash61      = "0e3f9da31f1b55027d3ebb7e6d723a97d0c617ccb885fd81f63d7863084793f8"
    hash62      = "24749cb17a511bbd5ceda113c762e72a374c89d527b2a9c24bea0bb6f5992e2b"
    hash63      = "3e5f69a0d1f18c5151c4f7b8220b342b395e8bf50f5610c52651878646b9e1b8"
    hash64      = "c2df742d836b24b2efa000b78f1acad544699070086fb0accf3a49f99cef3136"
    hash65      = "3177c5e3e97ae0ddd91e228ade681fe3f5c3806770d7bfd6c736da474ef48d8a"
    hash66      = "fe536e8e8894d955fb8b9fe6fa91413f7e83a4252f457a4c771d1a808d137b8d"
    hash67      = "bde415e20ceadbf3713eb8476ad66297c475c9a8289cecd49625f94f64c8b943"
    hash68      = "dde26caf508d4f91f3ff5f1cb151d3031fae1474ef9d8db5cd48d8df334c098a"
    hash69      = "05937629da10ef34613f75ab9734f581cfc8fe7b239c3521834916b6f1b8be37"
    hash70      = "ac421102319c2cdf6fce3a98228fa1f2c198a4cd71dd8d2e233a6a0aedeac2d1"
    hash71      = "ff32882e03c490121358ec7a804f3568b8ffd5a9e02ceedb0f66f7dfb951cbbe"
    hash72      = "6138804cc7d09d1855ffb4655e4129e1300287d78ffefebc773689651a87e4cd"
    hash73      = "15715a57f3fa082d7ab4df035bf81c31a196c29ec38a20939fddfe3dcf3596dc"
    hash74      = "4c1122ae8654312c35e4495a3682b48ba7ae41587af70a8256c103ac51f45391"
    hash75      = "4f2ac8c6a5eec50e093c9fe14e2597b691a6a0eda9867e17cd2fa17aba1e8a75"
    hash76      = "d759de9c016724326b323020c2201cfc633091bf7f104546634f64f801d26b1c"
    hash77      = "5efaa1696af50ac49428126485ae87feeea77f650603d96b6671d716271c039a"
    hash78      = "7c376bc9e491cfd6f040cc6e384542ef5bb9121501b1f55495f37db4af7b9171"
    hash79      = "34da0bb4a33e99968be1cd0ea017e62248dc2416825f94265151d9ce96baea56"
    hash80      = "929dbc215486e62939ea285bd957d04705b55ebae6604674381a2b21345b8f7b"
    hash81      = "efdb8fbf8b3c622e9a22daf5f0cae93abdd0f49067c1c5f09185d4ce495088d9"
    hash82      = "a1ab0aeea4582f6fbd965eeac158b8f523607ba5168e4ece3539af70d8ab061d"
    hash83      = "e9050e55a9d1f6a38312fbcbc681cbd1e772e9d380e7d2b72a56deff657f6c4b"
    hash84      = "87b662dfb948c3463937f2545934e339e4cf141ec2235333d44b10e59bc3c76e"

  strings:
    $s1  = "s44A/ean ~a~ o\"e. 1m  v 04<e .3ex  C 1gpoldt2u~8\"taSk .\"7tc-6-1ea6ee=  \"~DPiW1 d 571>at4e ooe8nm3cn\"ek=doe7ex  ff716Ic<c_S/" ascii
    $s2  = "            <Resolve package=\"Package_396_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1574_neutral_LDR\"/>" fullword ascii
    $s3  = "            <Resolve package=\"Package_802_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-2488_neutral_LDR\"/>" fullword ascii
    $s4  = "            <Resolve package=\"Package_299_for_KB3125574~31bf3856ad364e35~x86~~6.1.4.4\" update=\"3125574-1475_neutral_LDR\"/>" fullword ascii
    $s5  = "            <Resolve package=\"Package_365_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1310_neutral_LDR\"/>" fullword ascii
    $s6  = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1147_neutral_LDR\"/>" fullword ascii
    $s7  = "            <Resolve package=\"Package_367_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1313_neutral_LDR\"/>" fullword ascii
    $s8  = "s44A/ean ~a~ o\"e. 1m  v 04<e .3ex  C 1gpoldt2u~8\"taSk .\"7tc-6-1ea6ee=  \"~DPiW1 d 571>at4e ooe8nm3cn\"ek=doe7ex  ff716Ic<c_S/" ascii
    $s9  = "            <Resolve package=\"Package_802_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-2486_neutral_LDR\"/>" fullword ascii
    $s10 = "            <Resolve package=\"Package_396_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1569_neutral_LDR\"/>" fullword ascii
    $s11 = "            <Resolve package=\"Package_802_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-2490_neutral_LDR\"/>" fullword ascii
    $s12 = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1145_neutral_LDR\"/>" fullword ascii
    $s13 = "            <Resolve package=\"Package_236_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1154_n" fullword ascii
    $s14 = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1144_neutral_LDR\"/>" fullword ascii
    $s15 = "            <Resolve package=\"Package_802_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-2489_neutral_LDR\"/>" fullword ascii
    $s16 = "            <Resolve package=\"Package_396_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1573_neutral_LDR\"/>" fullword ascii
    $s17 = "            <Resolve package=\"Package_396_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1575_neutral_LDR\"/>" fullword ascii
    $s18 = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1153_neutral_LDR\"/>" fullword ascii
    $s19 = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1146_neutral_LDR\"/>" fullword ascii
    $s20 = "            <Resolve package=\"Package_235_for_KB4462923~31bf3856ad364e35~x86~~6.1.1.4\" update=\"4462923-1151_neutral_LDR\"/>" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

defa1c8b-c5bc-45b3-95d6-8db36496b302

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion