_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_474_1_Trojan_Danger_Ge_514

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_474_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_475_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_478_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_492_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_496_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_506_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_538_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_103_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_106_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_108_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_10_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_117_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_160_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_21_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_29_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_2_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_3_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.05E59CF5_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.08EBC07F_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0F7F0BC8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.15D0193B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.42FD3D2A_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4CCB2290_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.521AAD18_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.52E3D9F6_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.8DA43683_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.A22E0D05_1.vir, Trojan.Danger_Trojan.Generic.4385790_11_1.vir, Trojan.Danger_Trojan.Generic.4385790_14_1.vir, Trojan.Danger_Trojan.Generic.4385790_16.vir, Trojan.Danger_Trojan.Generic.4385790_2_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_7_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_105_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_106_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_155_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_157_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_161_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_16_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_187_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_194_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_195_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_236_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_239_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_260_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_265_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_302_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_323_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_328_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_362_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_384_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_38_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_411_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_427_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_429_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_45_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_460_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_476_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_484_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_82_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_22_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_5_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_105_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_124_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_50_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_57_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_79_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_94_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_14_1.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@auCCoZb.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@auCCoZb_1.vir, Virus.Danger_Gen.Trojan.ShellObject.S8Z@aeKx0jo.vir, Virus.Danger_Trojan.GenericKDZ.103285_56.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc_2.vir,...

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_474_1_Trojan_Danger_Ge_514 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_474_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_475_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_478_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_492_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_496_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_506_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_538_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_103_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_106_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_108_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_10_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_117_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_160_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_21_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_29_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_2_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_3_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.05E59CF5_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.08EBC07F_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0F7F0BC8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.15D0193B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.42FD3D2A_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4CCB2290_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.521AAD18_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.52E3D9F6_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.8DA43683_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.A22E0D05_1.vir, Trojan.Danger_Trojan.Generic.4385790_11_1.vir, Trojan.Danger_Trojan.Generic.4385790_14_1.vir, Trojan.Danger_Trojan.Generic.4385790_16.vir, Trojan.Danger_Trojan.Generic.4385790_2_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_7_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_105_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_106_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_155_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_157_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_161_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_16_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_187_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_194_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_195_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_236_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_239_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_260_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_265_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_302_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_323_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_328_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_362_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_384_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_38_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_411_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_427_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_429_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_45_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_460_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_476_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_484_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_82_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_22_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_5_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_105_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_124_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_50_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_57_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_79_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_94_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_14_1.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@auCCoZb.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@auCCoZb_1.vir, Virus.Danger_Gen.Trojan.ShellObject.S8Z@aeKx0jo.vir, Virus.Danger_Trojan.GenericKDZ.103285_56.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g9Z@aSb8tSc_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8X@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a8dhVef_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@a8dhVef_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aSb8tSc_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aeKx0jo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.S8Z@aSb8tSc_2.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "781bde89f4e206089144371e96c584bc7d9b971d72cf5b306eca81976a86d0db"
    hash2       = "07e56b015c76e737830c8ad82be8be9c989cfe131e6c89cda06c00f27150b406"
    hash3       = "a07373839cc9d4de5eff136cd60990292a648e9908333a5f40fe60cf14235eaf"
    hash4       = "35ebb5ea4d7018ce6d8e1a6b4d4d2d4b5f8b3a55326f25e123aefff25d147716"
    hash5       = "719b376083076db17f07b9c6182f56df0408e161cdec74e48fff09112f8bc1d3"
    hash6       = "743a9a029c955849e36a5a2a7a1dd5e7a084fe4ae606d260e50e1de4756b5c28"
    hash7       = "1141c2b66b3067e5387e1036be399cf46b35b67877f17bc3a56870f6bdd06c19"
    hash8       = "ac3d63967367a28a863859dada86f84ee602ec132979f1e17b404a55fd7047ef"
    hash9       = "c87eb0a67f2647edde070d61e981283c5c5ea13ad6861d7ea8ab391a5ff5edb7"
    hash10      = "413ea85a68ea9d6546feabce9dbe02e241816c8ab890a7d544405b6670055a72"
    hash11      = "f4599cf2464775c8e86ca9f1924efeddd85f200ca3e5ab52a48e4a844609e0d4"
    hash12      = "687bf61de79e2dee7357769a27f377c6508881753e61dc3e2119dd66aaf5938e"
    hash13      = "c5ef69bed755858045d33d9f119bf29b8145e53014f25f097cfb8f4c2c8776d2"
    hash14      = "91d15277816faee5cac6a7f2e8ff22c3ce7c7820560b980c7471c27c9576d9de"
    hash15      = "4a5a4dce7806f82d7779f4f1c59952d8c167e2717f36c42977984e0232a08eaf"
    hash16      = "9cc9a49b035bf61ec5ab4480951cad9913fe2455904ac06a2ee018919b7263fc"
    hash17      = "0e2c840eb40514912a3fce991d4497ced486bbee65421f9ea77afb034576d4c7"
    hash18      = "9afba3a3b7c797fc7f69e866937d1d9c95e5351b6a126e1438ade5e2a2a1687b"
    hash19      = "ecf718a1ed6b8c61d6e2e79e08175012442e8ce98124406958b404cbab6aa10d"
    hash20      = "14f6e70779b0370047a308a9183d1c1acb904bf510a28cfcb4e9e2ae44ca1c5b"
    hash21      = "5555044ac08e22d68686192ae2ec3d83f9fc479dccbb40b10c82795c4ba6d5eb"
    hash22      = "0baf4b8760a2c41901e5e530d130d24015c16db5b43a2f08f0e9fe76fbab0e51"
    hash23      = "92046a0423b1782714db7a1f82cca0998a43430624c0a86073d9988cdf60ec29"
    hash24      = "d5021a36759b900518806e1bfb33de6171f500651ac0cc328874e584098f484b"
    hash25      = "cd0c46ad9b3fcb977f1c0c27d0fd56c7e006c273ac8bde5cf5591b0d3fb5fbd5"
    hash26      = "c362ad324d492a428270299fc0c621bc32868fa38158fae4155bc423448a669e"
    hash27      = "cfc9e0908cc6f3c780211127c219c2d122e42ffcce2429e8240337c4bd5b257c"
    hash28      = "ae9cf37998d67ffbd305f13296081e26ac15802c27b49890d7d00bfc6752ee85"
    hash29      = "d62d689cd1a017e15fe45d54007a079af44a487eb84c13be30d5284b81a637d4"
    hash30      = "958f2ddd19a8dbba5e79895081ef2ed16eec9162c839c3d30009e0ca8cad84c2"
    hash31      = "b24afa688aa06503e55873cbf3ad5039463303f8ad55500d6042bab9e481ca8e"
    hash32      = "087e07f7b52e0a20cabf844fee7ead3f8e2ea005300971863f6209fd193cec59"
    hash33      = "362399f039e4923d623a828f423994646e51f611d0eb49d82255e7082aebdd13"
    hash34      = "bc0dc023a42edfb9118f561de93a389d6a8d9ee6a3e57b4fe871da69dbcdd655"
    hash35      = "83588cf0870bcaf673ce78951637da52b8568eb1ce6180e972a894d2fb190019"
    hash36      = "d28cd0ff8257251373835b04d31e6c635cbcbba35ae9378dcdf717f18e5e15b6"
    hash37      = "142ed12c9c2e7dfacf0a9cc607d9f9081c7e4b9402050f0842ab46fcbfa64f19"
    hash38      = "07a293997cf541404e9ca565ad13fa9cd4d21e4d4067e0dc08b5c519ab4d84b4"
    hash39      = "8db270674219024678946493e938f8e988904d8ed63f4e8b787ef23e4a051898"
    hash40      = "63323c94ec8c9abd95a4ddc79091d42436e9fbf68c58d04d293b0da63a7c767d"
    hash41      = "e94b2840bf79a07e8159172b9c6f0b7684009e4043f591ba8c896a69ad7d9de0"
    hash42      = "407bd71469a997c51f99211d09a0438f45aafc37c96941daefb100d4d72b35f5"
    hash43      = "a0cc388411513cc0933d6a09394a84dc13992a89df70fade4a5f455dadc5e1ea"
    hash44      = "81e03326ca57113a7a9417b82401181cbe13f6ae349018706026e58251be0a34"
    hash45      = "3e1781a70c316751325fd19b37aa71bd49053374e7e7680f0c2ec78fb6687ea9"
    hash46      = "515e97c63769775b0e4e88b8321a0f2765f13cf3c408de94797a9368143e687a"
    hash47      = "8e50019e21e19a1acdd590f678734db0044b9c090490ff4d07f98e33d29e7850"
    hash48      = "9b3f8bef7d65a7eddc2ac4a3c642bd43df78723fccf55b37b1d4b696a5ad069d"
    hash49      = "b773ff1c2eeee561e05ea07ab2eca1b61944029a57a61ea25e0954aced87c75c"
    hash50      = "a13d19fc23fcc75b73b0c84c87672aa4b3711ef0e8e8643b905943dd26798046"
    hash51      = "07d7511bf5387a11cd87581b5bc881e4abe4edb4273d92d2dc0498dd716beb1d"
    hash52      = "c56953b4641614c05a3cd3f4962ab5e673b80dd7292ff281d0c35fa3d4fc0a2d"
    hash53      = "c14a86ed5afcb30a35593723e8249a555b470245b91c9a370ce450fb7f5a6dc7"
    hash54      = "2d8954f905882a8eb75b95803a36d4ef91b7b7e683f02f7837ae6d7f173bb713"
    hash55      = "dc6443b9f5db32a22dceb873d221cc7aeb8d26b3efb3b57254b26962c8a3e080"
    hash56      = "dbc386da773ef5a57da69d60419ec1cf8d4acff39b5413cdb4b1c52139883c9f"
    hash57      = "8d0f9024973c52aca88a57635f3b5abdc0fca13834d26cc5fbca43005f05abab"
    hash58      = "33903fe6cf14c68fb139ba1c04ec75aa5ae5c8dcddec427c600e8842970c1353"
    hash59      = "ee186bb2349d6ebf101f7c7c57811fb295aaf2d07e124fc0628b208504a0f723"
    hash60      = "ae3b5276d034b3f24c94f7e194b7b87b207409281dde704027ef6072d8f62972"
    hash61      = "646ceaf3f9f582f778a85bb3a5eaf6b9ab664b22cbce7daaac7b26f3b596a975"
    hash62      = "63f28c0d7ff779e675406867ec2a6037528bb4bd1e6851c7951e08cc93c27184"
    hash63      = "76374db67e63c08f0a05a82855b0d44a57007564bc1955fc312857fe47eb8b7f"
    hash64      = "400c6743e7d93c377b5dda802d7a4e70cac2d141b4f32aaefb23a88a28184faa"
    hash65      = "ca6f5b476ccdf966630f9c8a5e8577b4bf737550899812577b46927fb3a7c1a2"
    hash66      = "c2dc4f18d9d98baffee257b922d0be99192be30a8e353ef350cf1c8636d0cb0d"
    hash67      = "199213f996f698a959170b118937c6acab97d7e0f3b7d47cabbb4bd3ee064ba4"
    hash68      = "dc7d05ea5a38f4cedf6aabdc0751baf5e0faa3a6d555d5bb6eec6e21415ce612"
    hash69      = "33dc2224fdd7eb5cc92244c24e26ea31e18ec438110259e652947e534d856ff5"
    hash70      = "2e65d215d80d11537cdf7075a51c230bb63df825c98e83c4f256ea5e2dc82ce8"
    hash71      = "c5c097203745d404bba24a5942816607153ad6142718c39ba8bed786c97cc062"
    hash72      = "2ddccb3bd6e265cead11cc503be72399b68a3743b6e2178418b6c6f8da9964eb"
    hash73      = "3bc2cd3f3c4c69377e4031790f0a0d5e70d4e3db21cf895fc078edc7bee35760"
    hash74      = "08ce74e5b576ba52ed5c676bca1bb02ced4291ae60837b73fe9183cc466e49d5"
    hash75      = "549259a77123a774b5e57536644abd5107d649886db8b82d6fcc8c5a29f60bcb"
    hash76      = "b106129dd680de57c85f123f93e07fea4874f2367817f6bba5ccea798fae2b39"
    hash77      = "8b5bdadb84c92f0e26708de9113d4da114c7c92316cfb2cc0aaf72fd5fd8736a"
    hash78      = "253c9adb6499274d0f2a994d69deb1108d4ec8980345a6d673174ed39701fe74"
    hash79      = "f6a9c40b7998cb97ab8033d69e6126b740700cf83ed18528d2fa26eeb9ad32c6"
    hash80      = "63ae54717e72054d4b178d33d455066e7f48d473baafd987e50c8efad928542f"
    hash81      = "947d488e97b0ba18cfff2ee4bcd686999a8128cef3e610667624d5347ad6f51f"
    hash82      = "f45e77fd2bf980b3fce82eaaca66435fd2df6746845b5fee147a7856f8cafce1"
    hash83      = "563dd34128d03ebdcaf1d8fbe7aa9b49110180268ca6023b48601f63b731830d"
    hash84      = "c12d4888cc3b1193f61a216575c1dc7e12e69f1c92c2662c2392d54534fa0514"
    hash85      = "125d1c8d7634440260c604d590435ea616562fa55eab301e550d44bc94acd964"
    hash86      = "ecbaa9b6aeddc9d372ae7d79a7acd97e2cdb7152ef5804528ccb8fab376067d8"
    hash87      = "088200e93325efbdb6b1adeead66907d12d1ec8e7d9500f2023d2f2e1e82960a"
    hash88      = "230b5a6774bdd2712db7d666e26873ee863c66b1b30a2154e3efba9b96d4d09f"
    hash89      = "1ef1a40a7d153c09b2b93e348cde15e85b2ceecd72654fcc3a10280df267fb71"
    hash90      = "ccf5430f95e687a2a7d66e189e4b898c55aa359e5b49d3a9115c1f94cc91dd41"
    hash91      = "eeeb8e5be64a04c24141d0c704c5baf75807af38ce039d0122c2299340efc358"
    hash92      = "a8f3debe9ee8585342e80c8841a7d2b95ca1fa22bfdedd3cb0a1ebbd4f8ac1a0"
    hash93      = "62e94f14a291a4e6212a62b41264a6cdfd7db1b74c35c03b919d5cb03b08098c"
    hash94      = "e465e82cfdb78793fdf2955b55d96b934e5438d20311ec21caf4320e82741826"
    hash95      = "373ccc78569161e20a0706551a8f61c5843961703170593ad2bb52b69c5b9869"
    hash96      = "1c9f334bad3d6d50fc8a960f862792248ab456606baeb6c48504b09dcd4b3ec3"
    hash97      = "c56ff72707d344a8a82bf43a3055b69a24ab2b94ebea2d022f70f552403b2719"
    hash98      = "cbff9742426a2d465a5ab401e2ff657b225a98953ede3a09b52c3b76a2abdb1e"
    hash99      = "aa9657858ed0169ef34df5666e9c5f57e3fea886a81153021ab07690c28fa982"
    hash100     = "103d6513b91c91df1584ba9871f300732b606a7bba40ca61eb71f37484948335"
    hash101     = "2b676fc0f1aa0907aa3460736fe19ae121dc2e87ee6c6b9cda0ab85221594e6a"
    hash102     = "ff64f162f047e1c511a04bf0a057303b316811b215f28d91301adcce55bee065"
    hash103     = "448de9a42e6ef7c0819c5214d6b1307aef434c666520833edc811f6306fef088"
    hash104     = "307c0aef6049d4db065dceeee0ed9e7170c6fe5d6a63cdfcd8297a8f0d5695a9"
    hash105     = "281e84d052376818255ef60f2b2f8703279e31662af32f0cf36308b51fca5951"
    hash106     = "3533775f59b746d9be1e1276684055896af37f412b1f821fc94f3dd75fc4b554"
    hash107     = "2597449af319f09555aa3cccd2bc5c7a36578f10d652848fa4766961b7c0244e"
    hash108     = "a43be5bcf8e2d4c695454245b447fa4866bbec69269b94d46c9d1fc77811fd5e"
    hash109     = "fd93b85c680172905aa335faea77c19c9b87fecdca9426eaab6a0be77d664da1"
    hash110     = "eaa515c100567ba83394e7872082a658473136fdab4808433369f67690c1355b"
    hash111     = "7cb908a143ae4a275271372d57b7932c6b42738818c21d296760e3e68576c1f5"
    hash112     = "edf2c8ca387ec3696dc137a52153096ee2afb1827227c22c19a8b80c3930be9d"
    hash113     = "33c70beeeb62d438fb81a55964bcb1b5a318ae70ca458ccbebe2f908c15c907b"
    hash114     = "95b6617b4059a2044087e9832ef9b0dbdfe6f6c7494fead91a5dbea4641cc118"
    hash115     = "2d162a58e61f46a90bdec40dc4a76309b58d3bff2c43e549a2980ab6645ed0ef"
    hash116     = "f80629e91f4328b31c21ff36a2f7c361ff28dc2dcfe25ecb839d568de12773b0"
    hash117     = "79b01413db0f2f6d74902fa2dc2a8ba2c6374d7b624f33aaa728b2df88f169f7"
    hash118     = "cd5278d536faf044d31c8f833a35589db0a3b6951879f31b65d8486d33c4b614"
    hash119     = "528ea5b41fa41b9e29c086199de95972fbe68d7384253a5022ac66f385acc853"
    hash120     = "6d82354e6e881efdb24f891ae63998c169e0b8f6874d73bc1df1d2ed036fd433"
    hash121     = "ddf234d081ef9bc21bcdc00159f4e1ba018854538e515ce5e542d3591908b5eb"
    hash122     = "078a43cc2b06fcbc01d0b76b17dfaaa7a0f20730c553029227e72b462588e1c6"
    hash123     = "3cb99fc68256821356835fc8d0c3b33e2879de7b3b1bf8f81387fed51a897815"
    hash124     = "1849eca4e2b55128226b8ade68792675683143bfeae3e578508ebe9ccde53e19"
    hash125     = "5c3d3432da63f988851b67203055a796de4d625271b6f8be1fd8d36c280e05ab"
    hash126     = "00d198b80454811a07b52d9b391d075597c13d0e487d973281b05c66a96c9a74"
    hash127     = "e11b18d43785a679d98954792ea4eea612f109303ac65bc6175f66c221f175d7"
    hash128     = "00bcc7e0e3cc9fc52939af2465789418faaa53821a99f189a61a45e0e6575314"
    hash129     = "7c680ce4c6c785ad6f301b6d78dc8628f44c132ee8b97388fa717c920775b94f"
    hash130     = "b9ecb2ca337273549865e284a30823fcf3fa9e7e435dac5990ec566d5b73cf16"
    hash131     = "04f3ca9c317e72f02db376765b85a62cc8222db143c8d1dbe4c72de28ad192f8"
    hash132     = "4c75ced27d100e2d0b79e7fd1663d39809bdf1403d4709e7bff6c191ef6b4fec"
    hash133     = "0e80cb983cbf5017eb83615b2b5cab562948983a0fe82a20e917bbbb3d2457cc"
    hash134     = "ee791115f87de8c11c8ac8866eeb8834c4c72e36ac8437ff2d918603867bad87"
    hash135     = "606042cd4354460c4ef10703d0eb641c4fe5f4a225dcae295137d4e7e2e5c3b7"
    hash136     = "482f886662a1f0beb8f914d1e882bb3d009c7d9059aa3d22b19b1d4f223f32e2"
    hash137     = "ce64fae69f2b03cb73f33bd9137fc6185e36693cd04326e71b82e9fd7e142a9a"
    hash138     = "a4d9f9ba894356f9cc209a51f431e151c00231e63882f8439185e248610a24ac"
    hash139     = "791eb26cb6ae7e63d5b6f3ad80a0fd3075f8924365497ae4775b5ea2a49b6868"
    hash140     = "f7be3d7c0d5d238933f908ec04df6200f088957a092c1604b67b12f25bc86578"
    hash141     = "1ef089378f1e3609c38e13dcb0291e80cf4821b77f853add2d0d9acc6807b817"
    hash142     = "92cfd8372a5a794a55d67996d2423ad3c991e12dfedbb5f4ee41cf1c56436ccf"
    hash143     = "71222be128e4986b1e7f5bac1d4c9e2722f31e353dffddd19629c7cc331a6cc1"
    hash144     = "646a905dca2fd97034cd35599542c20336bd052133c7bd8168f8f90a536b4a76"
    hash145     = "468b226455a8b6b7c000c036c26786c4b755e115f68900ceae379e6a650c4e53"
    hash146     = "29b85801de1d2e93b0692d842b8f387e02672774fad07fe4f6d23ddd603c43ff"
    hash147     = "2b06d8b9dc2396fd98c700309fd59ea3f4813f7b4412a16b2a1a63b9a1930008"
    hash148     = "ae6a43de44fe136496b8b37d8543ec9367c03ec396ea99189c2af70b06e9f8cb"
    hash149     = "837faf150a91a3eb6ede9caa561347c120a71268de198d82ca988d4d34318257"
    hash150     = "725780766933c0b07eb77af688217b4fa9d18dfc4491f4a1a7fafc3638e03a49"
    hash151     = "dbfbe8165270042db7ebe4b206aa599f9c75c0e2e133a8137e2fada51ca34ccb"
    hash152     = "0302dfc8d7c0724db4daf226fefaa4e3b7a0be76c9de69fb121e5ac3aa6e8fce"
    hash153     = "87b57d059d1fbdfd1194f024bb67490397299e0b9e4a6b85e214a18006c61f14"
    hash154     = "53d3211359366cd5ec3f56b5a9720caa139a08c40c0f863d525fca8d39fc67bf"
    hash155     = "b35b40726634e102172a9eed9bde91a89c7c4b63d54d5a93baa2b8e076c2b945"

  strings:
    $s1 = "s1 Year Subscription: A program license specifying a 1 Year Subscription shall commence on the effec" fullword ascii
    $s2 = " make the programs or materials resulting from the services available in any manner to any third party for use in the third!" fullword ascii
    $s3 = " regulations); additional informa" fullword ascii
    $s4 = "gFEA TURES, YOU CONSENT TO THE TRA NSMISSION OF THIS INFORMATION. Microsoft does not" fullword ascii
    $s5 = "individual is actively using the programs at any given time. For the purposes of Order Management, Advanced Pricing andy:/\\" fullword ascii
    $s6 = "sabove will not be applied to such taxes, materials and/or expenses. Learning credits are valid for a period of 12 months from" fullword ascii
    $s7 = "g(including the denial or cancellation of any export or other license); other event outside the reasonable control of the obliga" ascii
    $s8 = "g(including the denial or cancellation of any export or other license); other event outside the reasonable control of the obliga" ascii
    $s9 = "sIf there is a geographic region indicated on your software packaging, then you may activate the software" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "8a8b2bfe372245efb9b3eb8b5be010ac" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6204fcef-0c3d-4104-9a15-1217289fde74

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion