_Trojan_Autorun_Dump_Generic_Dacic_ADB499D7_A_E3380381_Trojan_Au_276

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.ADB499D7.A.E3380381.vir, Trojan.Autorun_Dump.Generic.Dacic.ADB499D7.A.E3380381_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.3E63B729.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.D96FB1C4.vir, Trojan.Autorun_Trojan.GenericKDZ.74320.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_1.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_10.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_11.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_12.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_13.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_14.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_15.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_16.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_17.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_18.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_19.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_2.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_20.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_21.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_22.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_23.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_24.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_25.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_26.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_27.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_28.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_3.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_4.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_5.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_6.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_7.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_8.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_9.vir, Trojan.Danger_Trojan.GenericKD.72853156_210_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_221_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_229_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_22_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_237_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_2_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_300_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_301_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_302_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_303_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_304_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_305_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_306_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_307_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_308_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_309_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_30_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_310_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_311_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_312_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_313_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_314_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_315_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_316_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_317_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_318_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_319_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_31_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_320_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_321_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_322_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_323_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_324_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_325_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_326_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_327_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_328_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_329_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_32_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_330_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_331_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_332_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_333_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_334_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_335_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_336_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_337_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_338_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_339_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_33_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_340_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_341_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_342_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_343_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_344_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_345_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_346_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_347_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_348_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_349_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_34_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_350_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_351_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_352_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_353_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_354_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_355_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_356_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_357_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_358_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_359_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_35_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_360_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_361_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_362_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_363_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_364_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_365_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_366_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_367_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_368_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_369_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_36_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_370_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_371_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_372_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_373_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_374_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_375_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_376_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_377_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_378_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_379_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_37_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.fWW@a0tiwSg_2_1.vir

rule _Trojan_Autorun_Dump_Generic_Dacic_ADB499D7_A_E3380381_Trojan_Au_276 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.ADB499D7.A.E3380381.vir, Trojan.Autorun_Dump.Generic.Dacic.ADB499D7.A.E3380381_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.3E63B729.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.D96FB1C4.vir, Trojan.Autorun_Trojan.GenericKDZ.74320.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_1.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_10.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_11.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_12.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_13.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_14.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_15.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_16.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_17.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_18.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_19.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_2.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_20.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_21.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_22.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_23.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_24.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_25.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_26.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_27.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_28.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_3.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_4.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_5.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_6.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_7.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_8.vir, Trojan.Autorun_Trojan.GenericKDZ.74320_9.vir, Trojan.Danger_Trojan.GenericKD.72853156_210_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_221_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_229_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_22_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_237_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_2_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_300_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_301_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_302_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_303_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_304_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_305_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_306_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_307_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_308_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_309_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_30_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_310_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_311_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_312_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_313_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_314_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_315_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_316_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_317_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_318_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_319_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_31_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_320_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_321_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_322_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_323_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_324_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_325_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_326_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_327_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_328_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_329_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_32_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_330_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_331_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_332_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_333_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_334_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_335_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_336_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_337_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_338_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_339_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_33_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_340_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_341_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_342_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_343_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_344_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_345_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_346_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_347_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_348_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_349_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_34_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_350_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_351_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_352_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_353_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_354_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_355_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_356_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_357_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_358_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_359_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_35_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_360_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_361_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_362_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_363_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_364_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_365_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_366_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_367_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_368_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_369_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_36_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_370_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_371_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_372_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_373_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_374_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_375_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_376_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_377_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_378_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_379_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_37_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.fWW@a0tiwSg_2_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "46bc7383fb4f03020984aebf3b6124b2a739580ca368f41e2b3759b673521531"
    hash2       = "147546c3f1b39c7425c86052ebb7c00005096c494caf0bf8051ee1522f37399d"
    hash3       = "f825820730dd4088d46f2227954ef480918b414d7bd57ab43d4b6e91d2746523"
    hash4       = "f20c496516ee689276966436bc5b3a4a5f853f82d3e82c57c849f8ddd414d5df"
    hash5       = "8b716c20560b8bed21adac31e03f4ece6595bce3123375432ceab43612fcc6a6"
    hash6       = "48992d37d9064d009e62cd6b45af3f4ce9c7094b3075a08641d533c7158a2844"
    hash7       = "838e9cdfe15b337c67b04790f2fd5af573efec8309f7fe0c0a8c842fbbc6499f"
    hash8       = "ae9cf661e3f4fd8a64b146150cfa91f3a3b467c06506f609b9bc77c931a6a285"
    hash9       = "8af038f25114a20886f944eaa1bf07cd30c94eeda42fa291323ff57f1567300d"
    hash10      = "cc6d9ccab6951200bbd008a0dab6708951397c6cc7b08f2ff246fb053a36ba90"
    hash11      = "8e6835de32f6ba6c4777d24207376dee7b6791de392e344b095760863e79b8ec"
    hash12      = "57703922a9909ec95913263ce68422881d5fbbbbb42eb4bbbb0378a10b69938c"
    hash13      = "62413a380941e5a78ed9d3688619c92ebee1fae8dfb13910e0f8db9e54b326d4"
    hash14      = "828e5cb4a65eec89b4089d3e08d7711863ad44fe040fcf2daf8e19d3da0df844"
    hash15      = "ef80d4ab8a782fff8cfe5691750d31e918144a57c8fbcdcd1cef63e258055d60"
    hash16      = "c36b30582e2bbd372f5f6df16f6d5ae791a18a3e0c3b7d2e28825119da15dd38"
    hash17      = "67ea90b3f8cc612e0c0b38f4bbf0080c3b3ce316f868c517274078d65cb240ab"
    hash18      = "852f595df71a420c4b5d5580949fe12c85b048775bd4a7174c3e6da9aac8ff9f"
    hash19      = "cfdbab85abc6359dd930a51758e8a12ad261b2f7d8b9e119584fdc25fef00e19"
    hash20      = "f1d7c910e1556855eb014159e8dd265948016b633bd55a1e37eca780d65f1e78"
    hash21      = "659815cc060759220ba897d1292af601fd7000a477cd9dfbcb577dd80a3a97ee"
    hash22      = "7cc61cfde04dd6e861455d7424d5d4dedc39a2098af4b1e983175dd2217f1ab5"
    hash23      = "82035a5515ab1628b84df0e31411070a7074c3340c0ff03655a3242e214f12c4"
    hash24      = "2557c0355418103c53ea80f6bef38fc6b2e8e9c9beaaf3734f5de9045fcf396d"
    hash25      = "ce41b0460e1d0feddb0f6f6015ed1bd731eaca06d8f039d3d341f9c8ef17eb16"
    hash26      = "3b1a78f4fd25b575ef5156a27dff6e4138598ffe42074a7d1e86905e8afb7db5"
    hash27      = "86cb3a6e06c0faa5c1f55f737e49b3467ad2ffa1411668fe41883dad784015ae"
    hash28      = "2f012d8eacb793eb829ec8bf66d49349760f8f5e65ea26b40c786242db79a436"
    hash29      = "c87679c780d75eb719f6bce07c3795e87d35392897b9e4fcecb0430aabc240a1"
    hash30      = "316ea5b2fc6421d9f961bf14e9fc01996238f85e009778bf545aa742c0e599bf"
    hash31      = "611229b3a5562d414de3743a1277f1dc5a98d494f27bf9b0e3459b5f6467326a"
    hash32      = "b30f17499001f3c822f58245e5c8e5dbf03e57efddac7e78f85f485398824406"
    hash33      = "10176e755290a2ee6180e2ececdcec224b129a214298e82f76481ee65923fb08"
    hash34      = "a700df16cba744d02acc9749382719efcd306c9f591d208ef2cd040e33073946"
    hash35      = "cbc030de3275fe543c6c43cd53ac482cc203fbc44dcbdd5d07fb9ca205ec52e9"
    hash36      = "c227a49cb02a7b4a68685197308006ff5479742b1649d8cffef73cc814d26115"
    hash37      = "93a415bd6513c8c617b94c4d8ec34becce569716f5524b6a82f1b1389979fb5a"
    hash38      = "cea60a292d3b91892fd073313366d7eb2521f858c87f69830a463802fb2459d1"
    hash39      = "c1a7b074d5d4d8aa3c01763a6c8d36cc8e68610ac1a836ba67cc0cbc4e37ff5e"
    hash40      = "97c658f1863f8d73823ca1ae65a802332e81318080e6c8dbb228958fe69db524"
    hash41      = "fe4d9d1e833220aafe054d355b67f576d15a546a085f1169c3feb0b42785c312"
    hash42      = "e6cd501f66cd31e513fd97d769b4ee770d07d5edc41e6fdc3b16395ed137156e"
    hash43      = "c1696c7420619215e36e0ff495c74f07c68885c785c002940b36de0a4b54665a"
    hash44      = "e4475f5b0ee1fe27e3da84d56932f28a62d793f029e7fd64de18c4bf49f155f8"
    hash45      = "65a2090ca1043a602bbdb97e45e82ed3c4563056614ace802987377b2bbe31de"
    hash46      = "79c01a9aa957f68e941a1f9a69728ade96617a449bc7ee1e3fdd8c68fd709893"
    hash47      = "1544bad80a45cb2095b906ec0b2c1ab9b7f3efce7374f1f84e8bc848e0357999"
    hash48      = "98ec78d78156acbd0d3d1d712e7aa0abc30ef6c81cdc1f6a602837ac5a832584"
    hash49      = "69957a4cdb19585e7cf78027996f0787449f3b32eb533cfeba1c0fcdfa5ea975"
    hash50      = "6def57b99a7024ff9491b888de2d121e6dfccaa23ef015c521a9d5fa013cec96"
    hash51      = "a2a2a861c42e9449bf8b9e6c7ab9c7e454161622fe5c1592706fb51f9d4e248e"
    hash52      = "d8def3b2660a630a162aa7af588a4051358560dfb3826d883f6cffbdb1a7a3a1"
    hash53      = "5e4ec93f49cf18d10ffc799c36a7efa5a837ded426865249138a0fe178f23fc0"
    hash54      = "b42ad6ec83e1be7b97db1573d6e8702dc5fbc1875979a9c4d23c79d8a9c3ba74"
    hash55      = "a0ada39509a78fc6c4e2f90d273688108c03f5806217cd726e92d02392a59164"
    hash56      = "d1a503b60655040d4f2deca2aac3b563d029e1fce4c59005dcf8bba6b766a804"
    hash57      = "8df5c570efb7b6f75727d646822ba92b77153381fada49e282ca4440499aa338"
    hash58      = "fb55124d9d482a4164c03fc06fb0e02699128c68a85c9009559ba8cd904d8040"
    hash59      = "1f3c75ca34e5a3a8779f616f29ede759750f0cbba6f136874899ee8e869019bd"
    hash60      = "ba8447670d2668402429db415ff47e486b6da5570332e9f909c401bd8028348c"
    hash61      = "5142d662f14bdc2f69c3639ec3e7c45584ad927bb8e7378379b91852d9675378"
    hash62      = "b497e197fdfc50494c71530ebe7c3d76d0b2450ef96dbbb761a6f3c62755fec0"
    hash63      = "2ec673eb80b01cce79958337f67f2379140f446605640535f8ac9f5706f59ab8"
    hash64      = "6b5641d6825aa1165c9215f3a91e068a81a25ac14533aaa7adbc3e8c3fd82b16"
    hash65      = "d9557f2fd29c994b4889998bf990f0bd966c9173b687f4ab242317a1bda54c5c"
    hash66      = "4111780c87972acc7396384dab024f11e2e7bdeb9e7048ce4657f741c899a3fd"
    hash67      = "bc418c294abab3552cb3937b0191d71d7e7ba77cd7d6ba366c9d39ce5d238f77"
    hash68      = "f24b6e17978cd0c5b77f1bdaec4d07f5453e7f693fb79dc61880d92efeb0f872"
    hash69      = "1f08f5b2c17e61d2dec83a06ba7788bb0f46a9030e79af1b04f937c9c5e81d61"
    hash70      = "6f5feffca6c086b31485d38ca98e0fa50e0eba4a4a930779fcdb143cf1e58b51"
    hash71      = "942763264fe9e9948db5d9a6957450f6c8a13f195b73f470b645809a7e99c50b"
    hash72      = "f96ba0b8da7203e42b76174fa1da93e30d7995ebeffd976692e8418da47d8392"
    hash73      = "cf41d0ca61605bf8582505ed906255f80387b4eaa698353e1ced94d287ff4eb7"
    hash74      = "c17f565d984037ac93d9cfc3c936bbc8a3dbe3e5891b3954aa1882362369947a"
    hash75      = "a4425a68949310bfcddf11b9f50835ff1db0e1995342e0dd55078902bf1b25b3"
    hash76      = "c9fcb8df18910b54929cb956141a23d02f8190b81af2ee714960bcb05eba0c1b"
    hash77      = "f732540c8e6d9f6d7c3f6a4fa583a01ed3978e91039268b37326b8d0852eec4a"
    hash78      = "d590c0653c156b8fe355246e9f0b905680b6b4320d94fe6714a58806ed281dbc"
    hash79      = "a9c17a73bb60091e568b1f3d7b7623df2106d6c5ae2839965a8ff7246ee3c7d5"
    hash80      = "b21874e53b3c031c2d3603ae2df8edee8fcaca104005b31e65fc067c99d754ea"
    hash81      = "86333dcc460f650221ceed7c9fe88e980656efea26bdd491fc34130cd99d1849"
    hash82      = "2817f9a412ff10a8e369ea9fa8e23156910f363e9c6a15ab50b70dec0dc7712b"
    hash83      = "7aeb515beffe2e890788dac0d164b218a7f1fe537da2f389d7f20a3dfc4ca43a"
    hash84      = "b8c700c5c210516409d9250d1160ae3869d1f4488578032a4f1adc30eaab46a8"
    hash85      = "2f180097449a1beaf63a8010f76090f2491fddc5da8d336ee36295185e73e2dc"
    hash86      = "b2cc87357b2dbf868bce5a7b8bee9a9ef5e498ae5f0c8b43078814f35713b77d"
    hash87      = "542100601c43be70de39048b45fedee1325f80d23d12bba568035608c104920a"
    hash88      = "255febcf826caade1f2b85a28497d3024abaf8c69778a9067bc6feb018dd4d81"
    hash89      = "2ae5448f812b3145f45a01745c28f258e24f26e59b70b966d103e4124253a67b"
    hash90      = "c2b832933018aa2b83383eae10f32b0f41f4305a9d78617c534cdc73a7c3f5bc"
    hash91      = "d57a0e3f40025ab13edc1c871fc3e98ec584dc3d047d2572d42013b7b4f476ae"
    hash92      = "9ebebbab72603dc90c620ba8c611f7a2f86de14bb6d22600fdcd86563715a92c"
    hash93      = "ddef979c271e92ceca997508797ef1e2d3d166a0c5c2a5cd3c73a4f9bdda2b47"
    hash94      = "fbe3c47ca88bf982666e4dcb6272c3294c77d0a49e4303c7cd45ded5ee8fccec"
    hash95      = "f4f56f076cb77290a0e49382798eb2e7f5f9b65e22c861740906a627d76d72fe"
    hash96      = "8b2c05b7b8f665001cadb6f739a5260f4d67fbaf5bdcfd5508b9c33cbd13bd3c"
    hash97      = "9ff1b4ea8785a9249fffbd2d427f64ab6e5317b72c553bde73f128d475ecc14b"
    hash98      = "817f3347d9eb29f46608939804d2784c195330fe44002e4a236379a01d507585"
    hash99      = "d0b780bf2dc2a15ae77b8272102e7fef09436e14db81b204f3ecdfc103fd632a"
    hash100     = "8c7da557921d2466a083f91640fc0e745853a956d76a23794a664f2b294ef228"
    hash101     = "6f510e946a1c7b37009ccbff06a320b70d8a90cadd6555b995e31cbe7afa77c7"
    hash102     = "92cfa3e17406e396389d0587ea2dc4b551e28caee34a763c4703976f71263116"
    hash103     = "6dff3ae82c20d7ec1b0628f8db4f036c26c3edf199759cb23d4190483350c37a"
    hash104     = "80458e660f1b73a33996f6d116f2e9f2b2ccc4ee9387557370219b116d374146"
    hash105     = "ca37cbe3d45ebbd4ded45c6fd933d818b60fb82330eb2eb982f95cd14a261ddb"
    hash106     = "d1e3ab272da84b5dd94c58003075ec2fb8ec0c17eea528a27fb61d56e3ea8189"
    hash107     = "9cd7a5b4a8031be01397125fe28b8a4e73c6b03d480963960fd1407eed4af076"
    hash108     = "25d6d4064c142a700bbb72e207cfe24fc3af29d492d05c64af03a2d2f3be33ff"
    hash109     = "4b73b52ded2b181eeb72b575183f1ff69bdc38031e5986e5fb650112d99933b9"
    hash110     = "668412ebc678529d8d5213a3f60166a0efb5aa1e7d9d0ce2f3f8ba8f5ef8651e"
    hash111     = "8f4d641150edd9d170c931a0eaab203b5d8a84674bab18add0d9cf77d6f8be5e"
    hash112     = "e58f130c158b3c35d1fcff4f86070ea9117976ed166966a20fe7c95acf3804ac"
    hash113     = "1835cd65f6ecff76c0e3957e9a3bff9f4fe2c8b9b846f064c4cacb35ff1037fc"
    hash114     = "7f3d18eb6bae5261ba094c06b26d34960080b4773803affae42b86a67c263d08"
    hash115     = "e1ac7f3671f0df6c047e44967494c3703f9740ef7e8ab838c4413429e3bb8ac5"
    hash116     = "d09b38103093ea261b56d2a342296f3663911e50dfa717eab43402954047ed3e"
    hash117     = "4a1facf4f5eb1c93c0862a2f0f2eeac0d3a9ac313acbafa7b2c77d075aa73458"
    hash118     = "cdb8b23b099dc0b9878bac98e00a0f1b5ebd3130b2ebe4dcf08d046268e2e1d0"
    hash119     = "08c970a31dbe333d6df50959efad2b56c1fe042fe92742d7800c36fa425e8961"
    hash120     = "1fd61f98e0e245ff43b5d09582de344099e78223b2cd51b45169ae37a92e8a5d"
    hash121     = "323301749d4f444c6b4a1aa4e0178ea8c1bd2fedf06f446e6d9f79a3bbeeb53e"
    hash122     = "9dc185f72294c8c5c3e9c93892f1dd3e2d052e1c686119ea1d282fb17f581b7c"
    hash123     = "69a246bd55e7575423a65c62d9f231f954333dadb693336a9340c0576c736780"
    hash124     = "409710d5ea447a5cc0adf49c72605cb99c9295920d4e1d7e15fd2c577eb2952b"
    hash125     = "fac2cda4edc1003a5f098a3a2d010274aaea2f00c177920893c73a483686e4c8"
    hash126     = "7a3b3706fa6875a7a8f80b8c2587e01957a8e580dd016e383d25f3c49094e167"
    hash127     = "d6c5b8cbf21be205d962b3b37476b8a3a727ffb523fa84806193a3c6df18ad31"
    hash128     = "190c6c7e92b68eccf5ce00a366ddd01b09032424989154bbe1367f91acc7352a"
    hash129     = "1f9b36379c78ff9b3059698c4f1e347d20e50987a6161ce99b20549329a888f2"
    hash130     = "a2b7e7f8c7fcca063f69731b3a15150d7fd48c8e35164468cd00822f3ad1e8e0"
    hash131     = "5e5f9ae37649bf59c0b3ae940b02e28ad39eeafa329e00614a823dc3649a43c2"

  strings:
    $s1  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s2  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s3  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s4  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s5  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s6  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s7  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s8  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s9  = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s10 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s11 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s12 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s13 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s14 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s15 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s16 = "\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?> <x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"Adobe XMP Core 4.1-c036 46.276720, Mon Feb " ascii
    $s17 = "67414D64B370CC238388\"> <xapMM:DerivedFrom rdf:parseType=\"Resource\"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>              " ascii
    $s18 = "tiff:NativeDigest=\"256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;C25C39" ascii
    $s19 = "185FFD6BD15AEE6E6\" tiff:Orientation=\"1\" tiff:XResolution=\"720000/10000\" tiff:YResolution=\"720000/10000\" tiff:ResolutionUn" ascii
    $s20 = "tiff:NativeDigest=\"256,257,258,259,262,274,277,284,530,531,282,283,296,301,318,319,529,532,306,270,271,272,305,315,33432;84AD10" ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0eca7cc7-af44-4d58-987f-d2c82d9b16ab

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion