_Trojan_Autorun_Trojan_GenericKDZ_94847_120_1_Trojan_Autorun_Tro_530

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_120_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_146_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_200_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_212_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_230_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_265_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_269_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_311_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_320_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_337_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_364_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_368_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_383_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_388_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_390_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_392_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_394_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_396_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_398_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_399_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_401_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_40_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_423_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_431_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_443_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_465_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_53_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_60_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_71_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_87_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_21_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_3_1.vir, Trojan.Autorun_Win32.Virlock.Gen.3_1_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_2.vir, Trojan.Danger_Gen.Trojan.Heur.cuY@HPIO3zfb_2_1.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_5_1.vir, Trojan.Danger_Gen.Variant.Ransom.XiaoBa.12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_19_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_27_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_41_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_48_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_7_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_101_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_197_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_221_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_235_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_252_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_265_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_277_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_27_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aOIIYRj.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aOIIYRj_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aSl2g6j.vir, Virus.Danger_Gen.Trojan.ShellObject.w8Z@ae@1SNh.vir, Virus.Danger_Trojan.Agent.DQQO_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_2.vir, Virus.Hijack_Trojan.Agent.DQQO_100.vir, Virus.Hijack_Trojan.Agent.DQQO_121.vir, Virus.Hijack_Trojan.Agent.DQQO_127.vir, Virus.Hijack_Trojan.Agent.DQQO_128.vir, Virus.Hijack_Trojan.Agent.DQQO_132.vir, Virus.Hijack_Trojan.Agent.DQQO_171.vir, Virus.Hijack_Trojan.Agent.DQQO_174.vir, Virus.Hijack_Trojan.Agent.DQQO_182.vir, Virus.Hijack_Trojan.Agent.DQQO_199.vir, Virus.Hijack_Trojan.Agent.DQQO_247.vir, Virus.Hijack_Trojan.Agent.DQQO_258.vir, Virus.Hijack_Trojan.Agent.DQQO_301.vir, Virus.Hijack_Trojan.Agent.DQQO_32.vir, Virus.Hijack_Trojan.Agent.DQQO_35.vir, Virus.Hijack_Trojan.Agent.DQQO_367.vir, Virus.Hijack_Trojan.Agent.DQQO_377.vir, Virus.Hijack_Trojan.Agent.DQQO_388.vir, Virus.Hijack_Trojan.Agent.DQQO_415.vir, Virus.Hijack_Trojan.Agent.DQQO_424.vir, Virus.Hijack_Trojan.Agent.DQQO_5.vir, Virus.Hijack_Trojan.Agent.DQQO_69.vir, Virus.Hijack_Trojan.Agent.DQQO_92.vir

import "pe"
rule _Trojan_Autorun_Trojan_GenericKDZ_94847_120_1_Trojan_Autorun_Tro_530 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_120_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_146_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_200_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_212_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_230_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_265_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_269_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_311_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_320_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_337_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_364_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_368_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_383_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_388_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_390_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_392_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_394_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_396_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_398_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_399_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_401_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_40_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_423_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_431_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_443_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_465_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_53_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_60_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_71_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_87_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_21_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_3_1.vir, Trojan.Autorun_Win32.Virlock.Gen.3_1_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_2.vir, Trojan.Danger_Gen.Trojan.Heur.cuY@HPIO3zfb_2_1.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_5_1.vir, Trojan.Danger_Gen.Variant.Ransom.XiaoBa.12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_19_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_27_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_41_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_48_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_7_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_101_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_197_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_221_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_235_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_252_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_265_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_277_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_27_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aOIIYRj.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aOIIYRj_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aSl2g6j.vir, Virus.Danger_Gen.Trojan.ShellObject.w8Z@ae@1SNh.vir, Virus.Danger_Trojan.Agent.DQQO_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aOIIYRj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@ae@1SNh_2.vir, Virus.Hijack_Trojan.Agent.DQQO_100.vir, Virus.Hijack_Trojan.Agent.DQQO_121.vir, Virus.Hijack_Trojan.Agent.DQQO_127.vir, Virus.Hijack_Trojan.Agent.DQQO_128.vir, Virus.Hijack_Trojan.Agent.DQQO_132.vir, Virus.Hijack_Trojan.Agent.DQQO_171.vir, Virus.Hijack_Trojan.Agent.DQQO_174.vir, Virus.Hijack_Trojan.Agent.DQQO_182.vir, Virus.Hijack_Trojan.Agent.DQQO_199.vir, Virus.Hijack_Trojan.Agent.DQQO_247.vir, Virus.Hijack_Trojan.Agent.DQQO_258.vir, Virus.Hijack_Trojan.Agent.DQQO_301.vir, Virus.Hijack_Trojan.Agent.DQQO_32.vir, Virus.Hijack_Trojan.Agent.DQQO_35.vir, Virus.Hijack_Trojan.Agent.DQQO_367.vir, Virus.Hijack_Trojan.Agent.DQQO_377.vir, Virus.Hijack_Trojan.Agent.DQQO_388.vir, Virus.Hijack_Trojan.Agent.DQQO_415.vir, Virus.Hijack_Trojan.Agent.DQQO_424.vir, Virus.Hijack_Trojan.Agent.DQQO_5.vir, Virus.Hijack_Trojan.Agent.DQQO_69.vir, Virus.Hijack_Trojan.Agent.DQQO_92.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a4d1d529747a6182d5918b68f059c6809ae0bcabb3fc3d3f311ea8a73de490a1"
    hash2       = "524b050a7417f3c956e5897fb8af012e4b8f69c764b2004dc9446da438f4a622"
    hash3       = "ff4159afc1a430c3c9cdc34e43ed4c20eb4d5d5208cf09d7a25f16e46b83ae51"
    hash4       = "8557a91cbe2abe21b5037a13c763e41d4d33b0536b749cba558a0726a4f96303"
    hash5       = "a3631811bcf36e981a66fb66e9e76c4f4f5d5ccd5ac2a2e6031cb671d64ee47d"
    hash6       = "7f4690d40cab1e5b294f6dd47f9a3778b2844cf4dfec585a426abc52090a7bd8"
    hash7       = "98b3bcc1a800460e08c4e483c937cc40103034f2f11766b356b7aee657be3dcb"
    hash8       = "b5281ebdc54d97c319e4c971d79cc09c813059b05f587d0b2fad25566c2166c1"
    hash9       = "80da2658297dc44e8843c965877c4163a28cfeda0396e9ec56d499ad8eb47c97"
    hash10      = "6c6c90e5cbba498e38a19f22df44525912da2ed253f984d271574e5bc11ff341"
    hash11      = "fb8fda37495fec9f0ccd7e3aea2bfda712f405d795dce0f580d60d30fae7742c"
    hash12      = "2adfef2363e7cf87074d4226464110ee3b09f56dd2ab9336dfa8d4ffd1d6eb6c"
    hash13      = "5ddc94cf4283f049a975675bb06b43220f0ebdc7ffaef75acb56103e7ed319a6"
    hash14      = "699d3ae5862feb3d23000de47c73b4d60d2362740b69eb1ab9763aefe2c8ad95"
    hash15      = "92e90e15d268f3412ad1b358bc36363ca696bf32f50de0a39657cca0e3b8bbcc"
    hash16      = "13f65a159bf3c5f359176444fba2d73e469aab15ecc242cd1fc561b9b3b919fe"
    hash17      = "0bb9cc780a142c2bf66fc8a5e84afc1d7ab39b1a934fecba43dd36a74e395243"
    hash18      = "2c25e1132a30340417c3c3760bf02a7a0a211424fc133e884d5dca7fc3355971"
    hash19      = "4f8dc428532464ab121b9fd67ab17d67dc5d58832830776b82aaf50aafdb2d47"
    hash20      = "af7698e7cc8a91818008e2d4aafc357355f0737d87e5ee169591261c83814e98"
    hash21      = "a87aca8914a1b2ae8fbf8b7a6aa93390d6303dfe076edf91f7ae4cc4b742e343"
    hash22      = "7e99cdd7193e623312e3c5f76ff0f62bc8dd6c03c78bb4e2649aefff2af35ee6"
    hash23      = "833ac7234597f27d8126216629af25fd10c4d3727674ba4b26a497dd5648366c"
    hash24      = "7aefcdbdd790cd021b91fd75015be8319383239a961cb1fe352d2b3a51746e5f"
    hash25      = "8c0d7f6429f236e14914524f9020499282562eba95fae2dc854fcf26a8149b00"
    hash26      = "5c7d47293779916b72cee25ce258b02fc266477d9965b59ddaa6f2d9b1d41b68"
    hash27      = "b24f0a17415d347f804b2f58cd382e6e9ba32d633f0b8d38dadb5890f9a51df8"
    hash28      = "ba2a8fd080478189201d0d471c1effbe8160dbd4f86b57a95581df01f06c2937"
    hash29      = "2e67b8ebbc3b89ef92169314485cb162306a7206be25c55a015ffe1d7366f44c"
    hash30      = "c0c9de7895db108c8c36d1de8581afa85c77fdffc85d6b64b7dfac9cfd7698e8"
    hash31      = "ffec62ec5233b7f9815d2d65c8ac632887938c97f29fdb76d476d94c3bc7334e"
    hash32      = "cebacf4dcce23ff9a9f13fe6b89b2bfa9622efbb573224bbffd5d5a3f0ab59ca"
    hash33      = "1d4d32d30d141ff0f7da01dcb28b2a654b759e4904c2401a6d2ff42562147156"
    hash34      = "3616a802b52f253edbec005e547f2fdf845155cd9024384cd438a4fdec07caf2"
    hash35      = "e53e73dd81c90d8182aed2aad4231f101597a8d73f8cf64e98a41a2dca95ce4b"
    hash36      = "ce8ab653bb4300c97ca111ca638701a5a1dbcfb9a832aa162817b20810dfc5b2"
    hash37      = "b522aa8b21f0b1f0dd916c13d7972a0462013bc63c2d0ac33ba734679307cec6"
    hash38      = "5675dafb6de1cdbb417ebdb6466d50d09c776649f9663eb36de752cb84f71131"
    hash39      = "fb679945494f095926055fdb63c3847e243505c40efd876698a9b2f75c6f0f74"
    hash40      = "73342498a73ed3bfe82c20667b7b5945b059626eb31dae282af3eea4031ca763"
    hash41      = "df2d7bc91f2c951bd9e348672e349004d615b2c4816aac9217ae1d2771974b5b"
    hash42      = "1897222c80ef61de766f8a8373cc4eaa13a94b7c7bbac5e2ccacae74a20148a9"
    hash43      = "5a782871fd947356924667817b9b1878f6e8fef796c2214edc89cdf982a77f62"
    hash44      = "75aaafec64ec84804861b19ecb24e528c353c4ea663155e38107251aa6891c6e"
    hash45      = "69dcfe2f51174b355fe3672600efdfe2cc13a817b8c24406db2e47964d2a5f13"
    hash46      = "3e1edb4ced97cb22fbc2967df8d31d0b9083802887ef9a9083ccfa0864b63d3c"
    hash47      = "06983012d52028c34807adaad3f3d7b040ca7e12b98a074fe49d3c0fc51a91ec"
    hash48      = "af53b1e9a298801226546ad7330c087e084292164b3583a13a534bb7ab81c75a"
    hash49      = "54b84734b6ec99f48c5f9c835bab5991820aa6660be55c32eed8941c4e2c6644"
    hash50      = "2991f033e8115c9b0c70528f9c2029a893702a0e6e54e0b41b75188ef1776db4"
    hash51      = "0888a98a5ecf6a5b1c9ced15c292bed5ea914d88530b972bc51354da019fd445"
    hash52      = "0a1b0d5976bf4b39f4704d538b489f0506a39eb744171d6808b25104ae4e272f"
    hash53      = "da5205d2e7b5037c82db10801dd73da5c44dc69a5681c4a63e0cb5a3aa255e7e"
    hash54      = "7eadcc418d6756387cf716448e30936770d3a13dee8334cceb7ad2dab9883c77"
    hash55      = "7b2c9361924986cb0fdfc1c38756a8acd95fc8cab385160f41e32eb1ac916a75"
    hash56      = "cfd801929300cf746de90163ae3912746126369ee48a61dbe2b6ac5dd7161474"
    hash57      = "66bbdb0de8bde3c00dd98fe021c36e52763176b6ceebb0120b116468d5b4fc44"
    hash58      = "0cc946cf3c0098896c8f28c8d466beb583c3ad326f4efa03aaf43a003d619ce7"
    hash59      = "68b500987e45a2974cfd94710a0a07683a97ddc3ad520be844a253b6365cc7d8"
    hash60      = "ca58cd98bde585dc9db0efa9d69465d4546d30bca8511bbafc3f5c5e85820d18"
    hash61      = "995c0a77c14b4d7db66542b3c4f5fb672aedcb44de18033bdc0132e2335aa43c"
    hash62      = "d9c7e25381cb91fca7a4eb4b59337c05a3a3de219b9a5f4eb95d8ef7aa8574aa"
    hash63      = "88101cc01a696125a0204888d4424c4e4a96d8426f3704269943fac9a7bb63bf"
    hash64      = "b6ff909251c63101f1f2ca6c3a780db4cd2dce60c03fe24b94274baea16d5b2e"
    hash65      = "704b09a10570f7ad886eabcf300c29ca63b2317b3ebb6d5096ee989be18dba84"
    hash66      = "533eb3649680730671f4fa56c243b4c587a1bea76cb8d878d02f4cd030b13ff5"
    hash67      = "b22caf292cd8cbbf273e4338d7a459d449a77ab2b771326ac7a149666c854419"
    hash68      = "d02796697405733c3edf8f6a83299b7c6cae056ebc9c717d7914a0037e248f14"
    hash69      = "b605dfc9779bb018e609778e8e32d24164b5e06e3e04ddeb8bad38fe1dece1aa"
    hash70      = "cea29d70fe961b05488fb5f9fd98f7a796b2710f4bc6fda0251ae266641295b2"
    hash71      = "9c7f811cabaf5b94fcf9ed5b29fe78fa02f128e2659befe7917864486782d2f6"
    hash72      = "04d7142e036717df2f1a48ec899815117f5d6fc22e7407d8424171caa5947ae5"
    hash73      = "fd86afc3aa6c890d848fc408485220751af5869dd294afca8887ba8219adda3a"
    hash74      = "218cba102073abfa9d7c9702161fc5dfca1eba16feefebb221315ec94da77811"
    hash75      = "9afef6dfea931e78601c47ee819d7f9454baead829ecd45664c44811ecfbff0b"
    hash76      = "c35eb5851ec2169036aa280631b1bf56090db0c8e8502ee67e0be36b00bbc1c5"
    hash77      = "852e8d69499501dea5dc2fdd13618613557d4b9bf6f57cfba075e4d93448f0a4"
    hash78      = "635c33e3640be44aa15b0bb91baaeb1006f2363e1a8870dbaa6504129d170b3b"
    hash79      = "4caf1f93e23e6751e21446c554e0bfb198c37908f472cbc478c554516154aafc"
    hash80      = "d8da1c4fe44874226c6acbd71386001f0d5029c87a1e27acabc8ecdb0e45a395"
    hash81      = "b91623aae4a83bdc17e7960890a943b44f9c8158b72c8b6e850497d4e3ecfa7f"
    hash82      = "204cafb141adf777bef8cc5cbf81bcc6457dbece560669a17de6f7772e5f91bd"
    hash83      = "21fb70854fe55a810b0ce68667a1c44e8a1f51ebadd72990a4db7bba8856be32"
    hash84      = "f87f1b28330388b696bc659fea36576ba89557c83393de2976b24ed7a952b4fb"
    hash85      = "eaafc020ae84d337abfa43d9a209a4af5bbd9ff178c33c4e301bff194a416396"
    hash86      = "ec746d2b8d8d7327bd3959bdf89724365e8ef89b3fda758acd363bd092a6a3c5"
    hash87      = "a9e2a8f176795b1ed977e2593c60cd9e88c6212a3e00a306b99d7bb456c97e98"
    hash88      = "2f279dccf50811788109f4df7360babf1dfb546fa68a08df812b6c4698d29376"
    hash89      = "4c5f93444ef4a1bd3088cea127ca765a3eefd558f8ade48aad931bb4a60e7c04"
    hash90      = "60fc804e886959e9e48c85d7df7d063bd07bb8cea90e2d7f4e95272bb8215407"
    hash91      = "8fdf34c21266194ef5152ec352510c2435f93eb4ff58ce807b7622a3bae8506d"
    hash92      = "88335c0292f0b2dedbe7b73a5f3c4b40aa07d79d2f6b053872e3e8751c9a9895"
    hash93      = "3bb309743767748282775f90efd2b4cefb268c961abc354b004669c29f336ab9"
    hash94      = "b0d2aa64278865a85b7acf4c2d27e3955a0d03a48a6bfdab85e3396ca084d4d2"
    hash95      = "d16edc5b6ae146f9e10d4a366d66a21b92e72080e5709d599d612ff72f4dc1f9"
    hash96      = "2862b90ec594c6636979253f6d72d6e1e02d25da5d151c8709ef24681c2f7751"
    hash97      = "4ae295878be5352171b15c3ecbdf2fd03e999677ccdad7a353b455adab5e03e2"
    hash98      = "b4eaf135603757fb2ebf4763414bde2c0256e83de095dd91d005cf2be975f40e"
    hash99      = "37a9db4870a041e5ac8e0d3a65fcf5dff51779aef0d159787fa28d3852f9c8f6"
    hash100     = "5217f550ddd9a183f772b9726cfe74444d05f6c6a588d1cfef02b2983be7bf35"
    hash101     = "3b60ed81367972d030ce379b0e53878a96bb9dc6f388e3e09a5f833142f3b46c"
    hash102     = "11d7cea1fad994afca9028f442e68e5e41f5f13686bf2ef6119a28862fbbc740"
    hash103     = "cee84ad41d4f45f10beb8b0e9cf770b332f30bb08044fac95262b20044d7ac87"
    hash104     = "50f857a3a4c00050a5ca5276af39d1e7c81167ce4c0c783d674c91ac2bc90b32"
    hash105     = "08999c6b828182e4859619c4f68acf3f1f47c3235ae909c029165bb819adde5d"
    hash106     = "41af08a2ff2d09738772a6743d5890f2dd8cf76c086cbc0ebb303d76126976b5"
    hash107     = "a227efcb3e93c0ce33986627d14299ba27183bbf934ec1b10500ba634ad504c8"
    hash108     = "3fbccb4c0941d2ba8709717af4569864611322f43748674f9cc3b5a76c79771a"
    hash109     = "f8531555510c3e85c4c5e3f90a7c9ed940fa1f4e9c94ed981d27dc57bc3f5330"
    hash110     = "24cc08bde9c9c6e34e8d48664cd7eb1f934b0cbd79d78c42ab4636dcc23b607f"
    hash111     = "b93783e00e711632fe39b27fa9759c5b51214c5b25e5165fc49d3deb1f98339f"
    hash112     = "906150032df9bff08d978605735266a4f5cb2959fa171ab4058f6caddd8999f1"

  strings:
    $s1 = "preconfigured PIP includes a business document with the vocabulary and a business process with the choreography of theD" fullword ascii
    $s2 = "s reasonable control. The limited warranty starts when the first user of your copy of theh>" fullword ascii
    $s3 = "+Subscriber: is defined as (a) a working telephone number for all wireline devices; (b) a portable handset or paging device that" ascii
    $s4 = "software, and to otherwise prevent unlicensed use of the software, you have no right to use the8<" fullword ascii
    $s5 = "reduced by applying the discount specified above. Notwithstanding anything to the contrary in the previous three sentences,S" fullword ascii
    $s6 = "party. We both will use r" fullword ascii
    $s7 = "s confidential information. You shall use the TRMs solely for yourk" fullword ascii
    $s8 = "qproof of purchase directly to that other person, without retaining any copies of the software. You may" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "ffcb20deb926c1b99ba12837178af9bf" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5b879b31-d384-4e37-b21a-e1525332b179

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion