_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_494_1_Trojan_Danger_Ge_500

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_494_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_513_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_517_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_113_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_114_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_115_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_144_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_24_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_25_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_26_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.1F0D2BF4_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.21067E54_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.23100B36_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_9_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4ECF90EC_1.vir, Trojan.Danger_Trojan.Generic.4385790_7_1.vir, Trojan.Danger_Trojan.Generic.4385790_8_1.vir, Trojan.Danger_Trojan.Generic.4385790_9_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_20_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_102_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_166_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_167_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_18_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_191_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_244_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_245_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_256_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_31_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_32_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_10_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_48_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_11_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_194_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_73_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_35_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@aKzulAn.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@a4Zmumi.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_106.vir, Virus.Hijack_Trojan.GenericKDZ.103285_114.vir, Virus.Hijack_Trojan.GenericKDZ.103285_19.vir, Virus.Hijack_Trojan.GenericKDZ.103285_196.vir, Virus.Hijack_Trojan.GenericKDZ.103285_214.vir, Virus.Hijack_Trojan.GenericKDZ.103285_241.vir, Virus.Hijack_Trojan.GenericKDZ.103285_286.vir, Virus.Hijack_Trojan.GenericKDZ.103285_321.vir, Virus.Hijack_Trojan.GenericKDZ.103285_376.vir, Virus.Hijack_Trojan.GenericKDZ.103285_389.vir, Virus.Hijack_Trojan.GenericKDZ.103285_419.vir, Virus.Hijack_Trojan.GenericKDZ.103285_457.vir, Virus.Hijack_Trojan.GenericKDZ.103285_500.vir, Virus.Hijack_Trojan.GenericKDZ.103285_519.vir, Virus.Hijack_Trojan.GenericKDZ.103285_559.vir, Virus.Hijack_Trojan.GenericKDZ.103285_769.vir, Virus.Hijack_Trojan.GenericKDZ.103285_794.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_494_1_Trojan_Danger_Ge_500 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_494_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_513_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_517_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_113_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_114_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_115_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_144_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_24_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_25_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_26_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.1F0D2BF4_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.21067E54_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.23100B36_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_9_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4ECF90EC_1.vir, Trojan.Danger_Trojan.Generic.4385790_7_1.vir, Trojan.Danger_Trojan.Generic.4385790_8_1.vir, Trojan.Danger_Trojan.Generic.4385790_9_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_20_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_102_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_166_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_167_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_18_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_191_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_244_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_245_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_256_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_31_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_32_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_10_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_48_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_11_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_194_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_73_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_35_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@aKzulAn.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i0Y@amFE@@j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@a4Zmumi.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@aKzulAn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@a4Zmumi_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.r0Z@aKzulAn_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_106.vir, Virus.Hijack_Trojan.GenericKDZ.103285_114.vir, Virus.Hijack_Trojan.GenericKDZ.103285_19.vir, Virus.Hijack_Trojan.GenericKDZ.103285_196.vir, Virus.Hijack_Trojan.GenericKDZ.103285_214.vir, Virus.Hijack_Trojan.GenericKDZ.103285_241.vir, Virus.Hijack_Trojan.GenericKDZ.103285_286.vir, Virus.Hijack_Trojan.GenericKDZ.103285_321.vir, Virus.Hijack_Trojan.GenericKDZ.103285_376.vir, Virus.Hijack_Trojan.GenericKDZ.103285_389.vir, Virus.Hijack_Trojan.GenericKDZ.103285_419.vir, Virus.Hijack_Trojan.GenericKDZ.103285_457.vir, Virus.Hijack_Trojan.GenericKDZ.103285_500.vir, Virus.Hijack_Trojan.GenericKDZ.103285_519.vir, Virus.Hijack_Trojan.GenericKDZ.103285_559.vir, Virus.Hijack_Trojan.GenericKDZ.103285_769.vir, Virus.Hijack_Trojan.GenericKDZ.103285_794.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "bc1ad44d6f5f6caf300bb309048d7c0dd67d4ae6459633d962b508e18fb9f3c9"
    hash2       = "6ea456622ea7630d33bae0da8258234044edd906131094bfb0d8c989b21f3159"
    hash3       = "b6511ac773691aae01ed28e449422767085c2eb4aa71274231130782afe79ad5"
    hash4       = "f4bac210a7151287a1865d7c97b97591fd4b13baf2cf36974bc68f2f64a8fff2"
    hash5       = "f5759074d271a447d94abeb31d3dc441bee97b02854fce38122b4dfc7557d6d4"
    hash6       = "8c143a4c18d358e1711664d55f00e41c94a83f98b63f23e0b5ecb31fcc921086"
    hash7       = "b4995f43b6f4bca18cb46f215f47749557b30d76fe8390e8e6c877903c2297bf"
    hash8       = "9951e29316d8fdf1eff2492b78493394a28ec9ac17095f2e4e424c0eb517934b"
    hash9       = "73218607a5acd87636e635e4210bcb1e1d201e9c0af2e4d6f7fdbad694db9286"
    hash10      = "8ca9bea8bb44d9478b248bff6c07d6f67403e20f3b6198b036424e9c9b887ee6"
    hash11      = "f77a6a98f9080a97e6c60d41fa0936d3301f4dbb1de64c466a2f981b65c4ce5c"
    hash12      = "08c885f2723e162b7954f8e1ccd16ac00660bdd91c68345ae0fac5ec851609b1"
    hash13      = "f278d75a8adaef93d6f0b91b04177b21a291a2747b8d61a8619efc1ae2f4b595"
    hash14      = "e008625b452acd4afe340074edb489bc3ac2bb6dfbe110cffdfa302cddf3e013"
    hash15      = "33b43c9c1687aa54cae7e5e45e7a8d0bdca99ae882c8e68e53a6603d3f6d5b64"
    hash16      = "bb47651da38d408f9453a7f6304b6965981c6faa56bc4b6824c4f9c2bb54d99b"
    hash17      = "59c9b358c76971dab37eee9e2ce3ed331c5a7cf3eb82c7367939a75b0519803f"
    hash18      = "cd546a3960a5046ad21c62955d67330b263b83df846bf4bae92f49a36dc93965"
    hash19      = "8d10b92c25813737fe0d608c113078745c559e798dd7e243c2fb5e011618dacb"
    hash20      = "0e02c4aad268b21c34d678c364ee475f0288c957414010d2687590d0f50587b9"
    hash21      = "c07e8005b2b74d05697babad7ea75381c6bc21f90d736fb5282d37ef64adc350"
    hash22      = "223270792da4f52cee5c0c5e116a40f6992c7c3c79a5b71f631d2b9b39f05dbe"
    hash23      = "8f3c45632e1f008ef5813dba968d41b0810cfde21f8f03a935b3d84ead2d93dd"
    hash24      = "80faea54677630dc7f06e7cc8dd96987fee78bfa4a921107617ffb8e8151d5d6"
    hash25      = "dcadb6ec19920b4f98a40dcae93ea0c2ccfb41291408c3062f90792204523e94"
    hash26      = "da5caee29d6fc831e2eba2bbbff45c1ababf98389689b13dc86279bb432b2ddb"
    hash27      = "512fcea2c7444a02d12883a9187a9afaf6081bd2147232a7c971b458ea24fe8c"
    hash28      = "f1817b6896d3bc3ca8734707b65f502985a35462fc6f3587d01c96b10535ce0d"
    hash29      = "00c9b6489e3853338844263928b210075f05c6b105a695174d9b90615950f1e1"
    hash30      = "8c6f3076b36d86c3cbfd3672ab83e4da726af8cdde71cafad46f245b3f7bdef9"
    hash31      = "e65c34b1b7f61d069da51a00cf9d80972b72ef62386f26dc013aa4e94902f9c9"
    hash32      = "646966aad39c6edeabb3facaa90ce5e22923ba3a277b4138b3477b9a692c5b3f"
    hash33      = "7177d9d0006baf11be32d4c157d59b020cadd2e27e31056ac2fc3e03b4e25263"
    hash34      = "0648a03fa172ea820d5ac7cdf09d7679fa5a651d5e53839874dbf1f791a1231a"
    hash35      = "246cc81fdd299ce361eb691cbdbe844420134c5fd4b3524bd27e1e830cc056ca"
    hash36      = "6eae6e6c5cbc13ac606d66abb8efefd25cf7b97816be5f6fbdfe039a605a0850"
    hash37      = "5c3f13660d9c09e28ed0b651907407cd499d61403e2653a08926488f9df1c741"
    hash38      = "af7f9ec7d5eb962cecce87cd7a3647943e4d6fd7f386928c31e2c176c3abe2a4"
    hash39      = "9d11098b1f9cca0629432e10509d0943232c1b9baa8c3b1748f1207b357bcf04"
    hash40      = "fd69fce43260cf018067e694deacf51b0c9384e807bc061f2664c5846e59a55c"
    hash41      = "323bbd357a0ac4bfe6f265ed515251c2124d361a8eb093347269763be3839870"
    hash42      = "f097ef6af6a3e22488fea40f1db60268d1442dbb33556742fa508deced818ddc"
    hash43      = "f59262bc9339c104012dd087b4ef4857abf7a16dea9803a53dab8a22cff3827a"
    hash44      = "090ee433aed416305b5021fafa58492c92ccfd37f89adafcfdee3c65a265c9fa"
    hash45      = "2d23d09e6d4f2ed825027485efd3a48fb530f73640f05adf859e68bc6d50cee8"
    hash46      = "4291a679149202dbd36439b4810d543512422a61563c285409d330ce3f8852cc"
    hash47      = "af4366ac2d18967ec69ff5d68d86ec0ad716ec5a949395636f9a597b433efdf5"
    hash48      = "91aef606802f85131088515777852bee763bdc5ea894edeb8efed8072061b562"
    hash49      = "8e1c3db7d9cd7e53c02df92b260aa73712ca73517a69c4ee413aa260d0bb68f5"
    hash50      = "d60a00249b42d28f2c7370f24de9c14c4da260a6647e97f9a6e49c83f9c03990"
    hash51      = "b81e28151b65fc910364258f669046f0f9130bcc01c32131f4801e79abd3407c"
    hash52      = "145fc0ec12950c641bb90cbdc18e962547d87ac9f86bafa00057282fe5fe18c9"
    hash53      = "608bbd57f9d5db40b88a459dfe9f96cc6b8785d5bf481467ec73666fd41ab2b2"
    hash54      = "0cf0ccba2cccb4c376de3ee6c0835300db78a3d38e5df5b98272aa654325ecab"
    hash55      = "860a7bd9583ac645f984ceeb3956383ccfa5b8ac48a3637bd8e654d896fabad8"
    hash56      = "a10f029c15461827dddb2b5ea0dcefddc1e2b4c1bdfc3ef4877c16cc9de62b66"
    hash57      = "61d354c79977d7bc7fd04e9e7fada2e84073eea5f98b79c530f7cd3843aed73a"
    hash58      = "9729e62af26007a8d77d9dff13f042b38bff596bc9f63fe610d145c388a6fc15"
    hash59      = "42916a2d8a4147340cc916851aca3f4045770e22842601078900def2eea2eeb5"
    hash60      = "f50b7de926899fc24ef0d4e4bf8c17e651b848d141354f0eb2bdc59b2d05dd3b"
    hash61      = "8d817fdf4b2e1307cbfec128f5ad5041fc909f3eabd57cd2117e3c555f5379fd"
    hash62      = "54301b61fac209e71a88dec7946fdcae2828161d14db201c8f321574958f63c9"
    hash63      = "2ef81e88ea82020c3568612946cceb278f4265fa605fc7b19c2fae9c0e8c5b36"
    hash64      = "c9861e20082a0c0c94bd81297f30c63209fa3699ec4e56ccd8b1be352b051894"
    hash65      = "e413907278d122a9eda566a8711668c785401277ca8cf52ea545c82372496f66"
    hash66      = "df1906a3ec1463d78efc614297630f0e5ca110a92beacedcbe64f0d81c496c09"
    hash67      = "1c220f9fd29b698c682f46a39fdc7bec33cc60222b41072f8992a5ab18250daf"
    hash68      = "27d974a1843ab0856a8bfb69a76ff1016d1c2cdf19156d566481f9d98572e1c0"
    hash69      = "7743ee2f7c673125d1a17773316c955ebe56f367dcc71eaa43b5e7e930224224"
    hash70      = "644db89416e607f6138c164b6a6d8675828371bc68b7f900e7837dbb153db0a2"
    hash71      = "b383dc2c5c137b9a0bca990f9c6e701d4fead1cc3bc5bffe8aab6a93054b759b"
    hash72      = "b293d123723f1c14276419181f169b283d8d4b8f62fb2589ff0a30309d8db09d"
    hash73      = "d35e61bbf5f12bc35702d4de1b234e1e6c53a6ff37557b02a278c8e96af2ee21"
    hash74      = "35fb13721f8fb1f4e56e1abe2da1d25d31e71c94d9558d629ccdfa9efbc55dff"
    hash75      = "d08a371bd61ea02edaa60993ba7a0ba399d9a03f26854b8ecec2e654dfc5924d"
    hash76      = "ebb23f8190999046c62cb98a1653e83977887807270eebe88be55b8543c5de9d"
    hash77      = "c4bcd4a05ba43404cb9fc6be936eede3895b77f0e2b807a4df3498301ccf0119"
    hash78      = "724d18978d1bdffe197b8bc705a2b000a477d0ff37d706f9ab539dd0e37168f3"
    hash79      = "1f41165de55f07c40469053a7a1dee9563c9756d721becc3c401dae5dd7d4efa"
    hash80      = "080f330311dd4b5b122b86c424273625afdbeaec04d28b19d895e4b5cccebd7c"
    hash81      = "7da7816314c7b19440ba245ed9121599fd747944b21a1cb0e81dc4ce3ea7a93e"
    hash82      = "31e82c00373b1a09058ae17e93912e4fff406cbcdb48db8f3e6d7a386e4db677"
    hash83      = "63fb806066cfd3f6f3220652dd6f9bd6934adc2c1b198c4e9e14bd604f7de252"
    hash84      = "cbf4c2ad45fa43be098e6aa8239fb982b510f6fa4f1b1840086445e16c1a096d"
    hash85      = "4962688163904ba9111c7dcdf8df4ba5b06d2e5692659140f37367088ce4b5b4"
    hash86      = "fe8eceae3ce08d5705bd7beb83fa1edb8e2f779689e589a0fb7724f563ea0502"
    hash87      = "bf62d2af9b74bbce68fe23f867153cbfec448ba53e8395eae9b0882e5c8b890b"
    hash88      = "06286d55d230a3689220706ff75d8652c9c7513e7e196f3a445ea791febd7fc9"
    hash89      = "b917a46d016aa64d17a08b92481166e49abfa5f3d0496c32afac901b41e610e2"
    hash90      = "db780fa2a270da16f798b00a333f0316501b9c856c40372557a2ebc09b9e8480"
    hash91      = "4759c3dfd2ad64f1def0416e99fb51e2fc23e26ef1e63fae55cd0452fb82a5d3"
    hash92      = "3e86f3d4808237fe11bd3e662af53fa9d947cdc0dc9e940cf873e65d57e31f2f"
    hash93      = "428e42689770d84842b2d1b4afdc46d7ce07d0be24c685f5085e409e11988548"
    hash94      = "4b311d73c7c9c162efed20d19b863ccc9696a262e069a1a20a9acf12f66c4ccd"
    hash95      = "4e2e04b83bf78b26d4e103c9fa57c2f1cc8f99eb3f8492b2d5049e4633011e06"

  strings:
    $s1  = "required and all actual users must be licensed.to create composition surface" fullword ascii
    $s2  = "of Internet users sending X.509 standard encrypted information. They also can be used to digitall" fullword ascii
    $s3  = "then current customer support web site) as necessary.Failed initializing object" fullword ascii
    $s4  = "license to use for your internal business operations anything developed by Oracle and delivered to you under this agreement; map" ascii
    $s5  = "Initialize fhas been activated by you for wireless communications and paging; (c) a residential drop or a nonresidential device " ascii
    $s6  = "license to use for your internal business operations anything developed by Oracle and delivered to you under this agreement; map" ascii
    $s7  = "Faildistribute copies of any media elements by themselves or as a product if the primary value of the product" fullword ascii
    $s8  = "pin notification to the driver" fullword ascii
    $s9  = "Initialize fhas been activated by you for wireless communications and paging; (c) a residential drop or a nonresidential device " ascii
    $s10 = " External are allowed to manually enter orders directly into these programs but any ordersrverVCChannel" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "8aa7a81d6883ed396c676fe550d3c49f" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2f9ea22b-d16e-4622-8a80-c709eee4398d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion