_Virus_Hijack_Gen_Trojan_ShellObject_g8X_aK5_lZo_2_2_Virus_Hijac_300

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_31_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_32_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_33_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_34_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_35_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_36_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_37_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_9.vir, VirusShareWin32HLLWLant_21.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_g8X_aK5_lZo_2_2_Virus_Hijac_300 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aK5!lZo_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gCZ@aCmWGmd_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.GuZ@aiy413e_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_31_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_32_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_33_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_34_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_35_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_36_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_37_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_9.vir, VirusShareWin32HLLWLant_21.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cca4fa1760aca6cbe222b18b1c58f021368c074ec35d13b5947999b164bd2e0f"
    hash2       = "3e08688d486a76355725ca71e78018d55db9746a962b5bf2de68102d78a85760"
    hash3       = "8ead3ffdc01f8f324cdf6fa8ddca36918fa8298845657c8ad4cb72071f75a267"
    hash4       = "6469a83dc217940c8e0d12abdf9e7e999ef56952bcf5da73682f725aa6b339e6"
    hash5       = "8e999f03af0f5374f3a93e1cb537a267970671c10ac3bb6fafd1a9c5d8a55ef7"
    hash6       = "b12589642d16c26c2bbb3f58b80996c14088a7119420580301a87b71534f101e"
    hash7       = "ec1044d880da5cfd0f6b1bfb8cd6a5311788ea349e14ab614f901273f4f19e26"
    hash8       = "494dd119dfb74b4411f7abd475f70a94cc51e5899b8b5a2c65561743b7edb945"
    hash9       = "349df66e086d35126e4687f29ccd84e24b777b1898c97153f6f56c3339bfccdf"
    hash10      = "ec7af83b1434017c1c6c029779100cd3b53e19792558970b15eb90e7e296cea3"
    hash11      = "49a248508cf03876e0c0a75b12bbc73c5fa17c186d15dce8597a5a9801393885"
    hash12      = "8167c4f3c725eed49daab09695f8ed7fa035fc209c898fbeb1ef84960518bcaa"
    hash13      = "c3de3d25b59fa179eae51b716ffe18645b57a9fce2eed6124d08fa5bb14eca9b"
    hash14      = "afc5c6ce9e2acce581a1b01e9d5ecab76385d82bad6bd724e2674c8b98a03df0"
    hash15      = "4cb45773aa5e78f9b74bc79aa13ab09f385809eba4b5c44714e9a1bf62684595"
    hash16      = "d8fa34b59b89347ae6317e5dcdac2ecd93cade06002e23a9f278d65c36d4ecb3"
    hash17      = "aea5d63d017533191174ccf1fefdc566525041ffcab87b390188dd572dc88e70"
    hash18      = "e851e6aad095796d7713604f47cb3da56e5d9646974579e3264dad569fca1f55"
    hash19      = "19135ab76c6fa7703e5f2e43853c45160ae4cf7859787a4652fc51dd88f8fe25"
    hash20      = "5115dee9cd6d4a2810a026c3155ee53de695306a83a3ffd3158f4560f1612da0"
    hash21      = "9a16424d455b54f146adf3dbd9c3e29a1e6f42222cf530bafc9fb8544b6355a2"
    hash22      = "a48d95c3f02def866993e90566406144fc6e9a8e51635550d07e06f8c98be72b"
    hash23      = "3e8d672e54dc750875a813c71bef17c513535162fb67dca48c879e4a8421b086"
    hash24      = "579ca2b74f9d66785855f7b8fef7bffe053e79884dc3a422f0178f2107298739"
    hash25      = "ef33b6974c953e6cf21d7e2d82a70f160f0f15b4163af5a499d4ee57a6cb6119"
    hash26      = "9d475aa64b2e9e849f93baa15fd2c67e3b3edef76ae5032518ed26369a8b44df"
    hash27      = "8f1dd7051f22f8fff9b87a7253b783489f3887f8661f4f341f0840d6a67478ca"
    hash28      = "4271815073c2ee2fb0c79d4667f8b1b0ab840951ad1ff72e74d3dede92217e1e"
    hash29      = "62b6543b7ed5dcbb89e31667bcf93cb8321e9628877e66b9afa4b3cd08483768"
    hash30      = "5ffa295cc12eb79fc1da1fc401e2f987bf0fe3e7dd976448122decb4e8ce8281"
    hash31      = "d56d9d355ce9eaf35d4bb77533cc2d6c54d77d61854b41283ab3e6732d143be1"
    hash32      = "253df54ef2138858ab0b5e411585f85ee4fb575052cf65cda025465da26108f4"
    hash33      = "5026249dc7c7fc131a02747c8548d89fb6a5dbb38d34d1ca71cfb76858ba95e6"
    hash34      = "c0abfce6adefcdb61f1a85a4fcfb300f591b28184a37ad686903e5b06737df6c"
    hash35      = "b6762e02c6c3a9637d81515aedbfa67d8d7c7c1e4bfabf910482585fee5b307f"
    hash36      = "6f551850fb2ae30e8ff6f6f2050b969ab6563adb9bc631fd0b79ed7a3f94ea30"
    hash37      = "08149da59f3d668fa42ccf1dfd508cd5589811a76273a8052dc19ac41a169a15"
    hash38      = "48614b046c9a71363bf5483fd444f2938a05de8a490eb4657087f9e1fc72bef9"
    hash39      = "9e5d683c7998ed7663352c1c95f86f7e73217c691c365926f76426f7246507a3"
    hash40      = "7f0d1ee79db1523ab6b6ec6e1563ea92eb8b0c91e1491bd5eebf1d69218ced69"
    hash41      = "6e2e43693a479b433552c201d1fc4c82f7a67512fefb54e93a0f465c4815ff7d"
    hash42      = "c19a4064f9ba6859fd14fb223c6a6d8c7b548352f33ae07be52e1d43be6fb004"
    hash43      = "419194beff24ea0784bd34c499b4ca7820f51e1d94c8c12bbbcf44ee7fbad90f"
    hash44      = "1430ac5ce01f9614bb28542ff4a6477a4b9d9bceca42bb842d9ead4e337716ff"
    hash45      = "b3b9f2cbab4329d82b96f29f221071809c615a2797f82dfc3acb6c5049177f88"
    hash46      = "bb5088d34afa36ee682138aed8f1d96268ef4c736b27fa06325c881efc0d267a"
    hash47      = "c7f1cee49dd0a0af524a88786557fc1f2d7d9517dd551e3418b5b7defd589bd1"
    hash48      = "8530e3cdf7c4c1f573dfa1ffa2470dd32cf25266305f08ae7b847af871acc09d"
    hash49      = "fd34482caf2bcbb4adac689c1979c5da05853d465a8e281cb0ea3054d22a8921"
    hash50      = "0f6035e58c98f87afcb710f6fdd8d1ab4d4b52e5a96bceace15958a3eb6de8e0"
    hash51      = "32cd2b16da9e099614829e258a6a3834f014090ff4a6004f868d5ff93f7a2b3a"
    hash52      = "bde306a65def0ed36ea6ca3475a4ba81caf918f43335d87582b88a7ed0e691fd"
    hash53      = "04c0ce803f432da8f8ee6d963b76aa8b5d366012f5ac48e839a4601da30250ec"
    hash54      = "8d17d75d07f9903f37215579f599c766cdf4b67bc5f0456d40fbbe19c1772c89"
    hash55      = "b64da2a7145c917b80ace2d31418df5938586a66d0c73b781d667dc23b3dbd62"
    hash56      = "d9e173b8dda9f8a188434c9cbbfb988934b5912b5b8b09664fa4885d1997aba6"
    hash57      = "3f0b144582e510dcdc05177d8af9bdd2b56f8ab7c2743f27fa0b9bf04bb41616"
    hash58      = "8347f09726c227a84c5c051c3cf8e8754969440608eba9f149f6c62f64f9fda0"
    hash59      = "9a68c12c97fb0ba0b09045d64cd0f5ad3c793e7de3ebc45fc1dea2d1e346da64"
    hash60      = "688ea97bc5665b93b4f166edbf129b1121d364fd10ecaeade0e05c5d3720e432"
    hash61      = "25d4ba4fe4efe14aa98ec538f5fa74e4d109651aa42d8e84aed367a355564a64"
    hash62      = "7a4e9fdaea21d88a74f03b9a93958b6cf7c4bb1728369dcf0e9a0f090524cfb1"
    hash63      = "ed21af234022186ccc65c22880702d9b755628f27892056b94d936029464b09b"
    hash64      = "1769fa3d7ef19268b689ddf222cf22729feb13a7de2a1280d88a8eef7e0a9f34"
    hash65      = "9ddc6340da1fd2662c7c8e0d3111f20ee86b0b352177813a697fd945a2b7fe18"
    hash66      = "39a107ffa4c827ed0702689cf617a7c5c07488647e63e8132b86c4903188ab94"
    hash67      = "6def49097ad17e75620655297f7fbf7e5ad8dd8eca135d1c86660ec17ed876d7"
    hash68      = "77311b5befa85ee0afc85e7fbe13b7eda88dbcf6f8ec68c4a9a1686a753c5cda"
    hash69      = "68d0913a23e38aee84a3b9176595b8fc6f85bfd7497a95a1d23b9ba9c70cad94"
    hash70      = "84ae8fb70597b294f97dc4bb4413cfaafbfefb740950e2f6a52d7b8bed897913"
    hash71      = "9dd3805284dccaf1b8c3e65167a00abd76ced40767c66571ee4929ec9e27e830"
    hash72      = "46ca77c13ede88ed1dc4be9b4cc30c743288533e11b54a6e7139123a19ce8f47"
    hash73      = "6e7b0121a24c81b878cc94b7ef223ddd76700827b9594df4c1b29ca119820a9a"
    hash74      = "ae45ec32262b92c17859afc16278f5081c7f8c5b12686b1c08898bd8b70bdbed"
    hash75      = "147f6e392f4ef9f71e87ca4c96edad03d51135859d4e3ca008f6413dc30a2143"
    hash76      = "f367dd558e281a5a21a9ed8c20fd310358aeb2587c64d3a0c088d11602ca749b"
    hash77      = "33c99b8ea1cee9bac26533576ce442ecfd94bcdcd1a1d00dd5780f8c5895ec34"
    hash78      = "d4edd5127009a051324b3512a39727c1e9f869e49b40adc74c4d17316513fc8b"
    hash79      = "182f45879c94f199987376e75b1295e3cb2c011b5110979a23af1c6ea22b2d4d"
    hash80      = "96be57122e7f5855139da13eb80e688e021596160e11e4bba7a9119b2ec104be"
    hash81      = "f4177013283d3ece8d2453a5e0a84612c5ce14d5fba58b4c90296b5a9ff697c4"
    hash82      = "c8d53749776cb3c24981381ef5cc2f897b33dc7387af1c807801d668c38cba27"
    hash83      = "a523e6ea004b8133989f5008cf954f4f9d0e16d8112ded4f68e78e386a2a3911"
    hash84      = "c875620f44ff43dbc8c09b30985d564388201dfabd13ee526241bcedc66cdaa8"
    hash85      = "067b3028155daa84c5b189d6ef0c37f1fdd288b5ad2b2a861133afa1a7e4fb0a"
    hash86      = "70b94b40e552424eda88a3d08b44cf1075856ae9e30e55df196b562d2a91d94e"
    hash87      = "2b766deb0723b52c8a0c2d7b948e98878c7e644fd5bd047acc8ce0ef0344ebfb"
    hash88      = "ea6ab577d1e243825ac23495f0b0d89472d761eff8fb21de1c05095a9bb9d366"
    hash89      = "d8bf85da35865eca30b850091f1b9f255a0f39337e4f82cd17b2ec8e81bd569f"
    hash90      = "71dff39979d6dcc50c75d13735b05408c624d774744a28d5e4bd4f1381b83fff"
    hash91      = "365fcbadb9b41e851f9ed0ee9526def0c644a230adbc1389757fa48411d76791"
    hash92      = "a3f9492770428085e51214964a83e86a3b93943ec103cc6f8f516012982de0b2"
    hash93      = "ada5d0df73806a28532146e7bb51e96b60fca98bbe3615bf854711e57c2ffaff"
    hash94      = "62f36760b80c166ca86a8354e61ef7fe09ee6e1072d7b369f37d20a0aad6b74d"
    hash95      = "50d53360c0ef139a1eff69c97d913c0b446edb6720db59c2a4684dce9f8dd69b"
    hash96      = "1d849ba14281d575a0f67c9d044328af85f7dc30ecc2561fcd6ad97da9636966"

  strings:
    $s1 = "Hello,World" fullword ascii
    $s2 = "n !Library" fullword ascii
    $s3 = "Accept: image/" fullword ascii
    $s4 = "Movie Maker" fullword ascii
    $s5 = "InstallShield Installation Information" fullword ascii
    $s6 = "MSN Gaming Zone" fullword ascii
    $s7 = "Raise " fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "31d1c48ee7d8e07a5706e963146db875" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

600fade2-97d1-4175-a7be-5a9ef0912791

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion