_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_483_1_Trojan_Danger_Ge_553

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_483_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_527_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_530_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_88_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_93_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_99_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_130_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_6_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_96_1.vir, Trojan.Danger_Gen.Variant.Zusy.544421_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0388272B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_12_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.7947C78E_1.vir, Trojan.Danger_Trojan.Generic.36486627_12.vir, Trojan.Danger_Trojan.Generic.36486627_7_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_11_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_12_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_146_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_152_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_172_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_200_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_227_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_232_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_249_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_270_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_296_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_313_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_333_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_355_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_359_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_372_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_388_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_3_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_404_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_408_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_431_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_445_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_67_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_72_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_79_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_86_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_126_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_133_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_175_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_181_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_216_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_12_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_13_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_26_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_172.vir, Virus.Hijack_Trojan.GenericKDZ.103285_203.vir, Virus.Hijack_Trojan.GenericKDZ.103285_264.vir, Virus.Hijack_Trojan.GenericKDZ.103285_275.vir, Virus.Hijack_Trojan.GenericKDZ.103285_287.vir, Virus.Hijack_Trojan.GenericKDZ.103285_30.vir, Virus.Hijack_Trojan.GenericKDZ.103285_398.vir, Virus.Hijack_Trojan.GenericKDZ.103285_407.vir, Virus.Hijack_Trojan.GenericKDZ.103285_49.vir, Virus.Hijack_Trojan.GenericKDZ.103285_630.vir, Virus.Hijack_Trojan.GenericKDZ.103285_647.vir, Virus.Hijack_Trojan.GenericKDZ.103285_843.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_483_1_Trojan_Danger_Ge_553 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_483_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_527_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_530_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_88_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_93_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_99_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_130_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_6_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_96_1.vir, Trojan.Danger_Gen.Variant.Zusy.544421_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0388272B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_12_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.7947C78E_1.vir, Trojan.Danger_Trojan.Generic.36486627_12.vir, Trojan.Danger_Trojan.Generic.36486627_7_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_11_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_12_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_146_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_152_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_172_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_200_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_227_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_232_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_249_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_270_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_296_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_313_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_333_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_355_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_359_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_372_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_388_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_3_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_404_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_408_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_431_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_445_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_67_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_72_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_79_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_86_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_126_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_133_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_175_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_181_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_216_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_12_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_13_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_26_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g8W@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aCggSqg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.J8Z@ame9q4b_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_172.vir, Virus.Hijack_Trojan.GenericKDZ.103285_203.vir, Virus.Hijack_Trojan.GenericKDZ.103285_264.vir, Virus.Hijack_Trojan.GenericKDZ.103285_275.vir, Virus.Hijack_Trojan.GenericKDZ.103285_287.vir, Virus.Hijack_Trojan.GenericKDZ.103285_30.vir, Virus.Hijack_Trojan.GenericKDZ.103285_398.vir, Virus.Hijack_Trojan.GenericKDZ.103285_407.vir, Virus.Hijack_Trojan.GenericKDZ.103285_49.vir, Virus.Hijack_Trojan.GenericKDZ.103285_630.vir, Virus.Hijack_Trojan.GenericKDZ.103285_647.vir, Virus.Hijack_Trojan.GenericKDZ.103285_843.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "f573a2c7b76bd5dbe53991972f918d9695d7b8d80ea1caaca47f6109c01ce14e"
    hash2       = "7dfd555f37b05deee47322830f4feef082783bbee1bf2c4a0f6f5f8684fedd87"
    hash3       = "74177c7ab2be0b06a4e949206aeeef069b087647f0ec4289ebb535f2bf9c380a"
    hash4       = "872223d44768e670413a686927a847438ec94247c53675a5f7421095c3d8d4d2"
    hash5       = "069b72b0606a8b053fd7d773a0fd8f2f0ba25bb91cd5e938a581cb9b5983749a"
    hash6       = "79e45cecdb35fa757cda77a410cc71d18769e7a72b41c79d685a46928cb4afc1"
    hash7       = "5c0cc473849dab5c16bcb50e08a970122eb6010e92445d0ea11526996dc9131e"
    hash8       = "7e30816e0f62dc44cc59d535ea6741978fb42c5731571956fbb90bb7c4ce048d"
    hash9       = "eca15494c6c236bd22a3b0ce5823276976fbc69981c8f7af2daa9718f7445c40"
    hash10      = "63026e066458f326891cebc8f9b2971f9fe2bebdc1b8bf2d45d0f98cae3adbc4"
    hash11      = "6965552310202f545bebb95a23f484dbfa2717238ffd9b6eab002083fdf6b8e7"
    hash12      = "bf793e207a387c089c92345d74a96c529b73776212b2e24c98d430344d203250"
    hash13      = "05c41d312b8df1898c51872cca4493d86764eeacf6cff5e96e354403d5536da1"
    hash14      = "f9ce6341fed9ced8f5a49b0c27466030003bf7c9f1b8727e731c439b1cff86b2"
    hash15      = "cb8d75c108d448d31da9b8f31d63595c02ea37d651bad2e984f0d5f6ec775227"
    hash16      = "9d66fc204f500e8d83c093be0935d441956a5f449e0588fbd26223cbe3672e7d"
    hash17      = "3ebb97fb0c28a1c892074371bd258b3f88efa2d49fcdaa56e82dccf1ce1d7af0"
    hash18      = "e44615eca73af1e4d2d7162f2baf4372206eb1d25082783310899f6d9f608f57"
    hash19      = "7584c40e4e874544153ff159431382f92a442de07b8f4549c0287af9689a047d"
    hash20      = "a803d41727636e99489c772f4212f3b7f72334579c0ba2fb773f28c1fa2f1732"
    hash21      = "94fec2fe6d10a46677e155ca0d2689fb2be754a46241b82e1019bcabdfc42801"
    hash22      = "8f0af1b42a5132c54e504da31c3d57cdee48a8180f84c462907228c83221a1ba"
    hash23      = "b9e889e52bed2d123c10000fc3e79fef9c858f26a2a06dfd6304d17edfa5900f"
    hash24      = "873121b7d1e23d1dd939bf9ad147ec6b10121a9c3bca277ff324567da97e03e3"
    hash25      = "9564d89bd4e24fb03f58a3f1e4a0c24df832a07ccbaa89ee5b5a96af211d2676"
    hash26      = "7c257fb70918d6b37cef522394d69f04f88e04d8b4a117ee4487ca30feae4ad8"
    hash27      = "5d6b1d7c0528ba9d73c75f51e8055cb32108936b3498c0526df28de3d5ab1e0c"
    hash28      = "0d2e50f8a100822e07a6b0a75d8787b28610fabe1dcbf13c12cab04d07e81704"
    hash29      = "e6349a6717e89e3fbb6c710a334565019f0ee48cc933761899bad769f3147868"
    hash30      = "b5e0a31939337c13fef1f1ae81adcb62b8db4f699a1e2f90e1e1cc230ce68d7f"
    hash31      = "cfe25a886a087e79ab6a4fbc8634a1962a7eafd53655d5b39fb6a0a6ef4a580b"
    hash32      = "112c242398e443c5692575c1e4daf82282267877632d9ace4a78ea53217ed75a"
    hash33      = "af796fd91f388d7a340410149d4e334a12d66218a38433f5416d917c74b96ec1"
    hash34      = "bccbeed7918951e1b15daa053b88ac5e5ff1c9fcfaf439885b152ee894819119"
    hash35      = "7367e37a829eb381194bd6d3c56482ebf026b0879d1303f5d847bbaa13b8860b"
    hash36      = "80529a6e34e963da8ccbe25d678ee7d38b7f1df27c8ec77355c4a290f8a4656f"
    hash37      = "6fe5beafa8e160ed956e4ac64b3bfeac60eb4f843a57694a6e927a53c0cd9aa8"
    hash38      = "ec2371e9d4034b3247473635bc986204ca9ec82115cd9c9452a7c31aa6f433f2"
    hash39      = "e94f45457dc6aeca17bc9ffac58527a7564ef4673bde90dd27ca7720ad0c4764"
    hash40      = "b69148b71df23be9444e9d053f6487ec347db8aba26ba1cbf9dd1253813c44a0"
    hash41      = "28a3d35d70f147bdddfb1a7831e816232509d1f0afdb32d6b6defaeb15f003d8"
    hash42      = "dfa7132f1a279afe8afa2ba981cfd582985340f746cc6e5e75e0a174f1713454"
    hash43      = "61f7abed12e2321678dfaa8f795191270fdc88d78281fcd3fe239f1b6f635ea8"
    hash44      = "fd9a6c181543de3ab399f66dd4b01b13f0c430df991896cfdec1e2eede6b4bbf"
    hash45      = "94ee8f830cfbadddc0bcc3542848f2ead6bbe24ee04fb66871587a726cef0cb7"
    hash46      = "54d8cc5d863709f564847a652f59dc5e9ef9ef52a8cf75d79be7f268ac3083fc"
    hash47      = "d65b89d1247f82b0ba75e8d35ebaf96838cdbf0a26c3ecb7c3161cfe8debc67b"
    hash48      = "1bbb05628f35fd045241dbec3fdfcde9d6bb21e41f2908faef57030c37a43708"
    hash49      = "c86cfefc0189a896356572047413e1e2663508a39b9d7d4dfa97f1f9122429c6"
    hash50      = "e851743c15cfcf5f6bc686e661cb7428ceefab902e1e62e06e7f6362d0ee2199"
    hash51      = "f6596a68fa3c1eafd4a9661bf993fbf91fecbe2d5d58aaf18fe4a235d311d38e"
    hash52      = "1b687e440ddda4675c15965671705d7de916168a3a96f1914a5af948e81c03e0"
    hash53      = "470f031a55fb61452307da5de874871414367424f4443c95679ef500014ca604"
    hash54      = "0dd8c67bb165958bcd8fa6cdd17152bfa98f043d90b2d038f56dc508c1df203d"
    hash55      = "6ce922a1ea80b69edf19b0a18992d8a2a0ee1a89b53901301c848c772e71cb58"
    hash56      = "03e8c7791ba320934b9dc71aa71d70570d33fd7037328db7ae01b45cf5b11337"
    hash57      = "432ec210cb31563fc3e73c845651a42a854f61fcfd28f07b0bced119259048f0"
    hash58      = "26376c36e748b70340319404ba3253cfba09ba0e947cb0b74c19bc498015c482"
    hash59      = "bb9fda9495a31ba06bc31831f3d869f7a8a59f54b0e06b8162b4659560ddb383"
    hash60      = "80acf571b029016deb74f23d14933c5f80949db45014eac14ce53e84c50321df"
    hash61      = "932d7d044dcf1dba0502a112ddd04ba09b2b80981ca6c604bf3e00bbd08e2363"
    hash62      = "179715456e91c8dd311c88eef386093a393d4683596bbee659268e3635a9f9a5"
    hash63      = "6d067ce20aaf719470af94a9ca4adce2160e359bab394f8c01733857df4c354d"
    hash64      = "a8b1cb0ce65c7a12df64e1bccca3563e2d9e2d0065a8b15917dc70cd10d2912e"
    hash65      = "a02ae37750f9ba3da2212ce89e81402de439f382322a49b6fbc0aebbb04bae8e"
    hash66      = "9b07c73ed942f4b342961b6414c1d0cee3dbc22cc0d7c5dfa325d1ee97e69fb6"
    hash67      = "6ff4a33ddae7ecbebb544847038806856de4110872f9a7a974561a9b502f91cb"
    hash68      = "c9ac45689a6ffa1cc4445e2c8446ce043a732010a1c66c3ff1a4cd402cd15485"
    hash69      = "6fb5e2068ee9ad7decb92b121c03be85ec6c67f3f25bce0fb7e945bda7278bf8"
    hash70      = "a691488690378cf0a2df711ab5512d750e97f97b3dea510a69bf0594b77d2340"
    hash71      = "ee8202beb97ee3461a3ebeab7dd2bb61ad154cc5e2ad6d4ba2f873c1a74727dd"
    hash72      = "e85efaf57ba1cfd77e510a04163b3b3ce12efa49ec8ae6d4e7665006afe52991"
    hash73      = "414cffe5159031a97647969a338a2bc0abda480a7152d782280afb348bb18d82"
    hash74      = "8183c594e2b9badd9a8460b1816dd29afeade653e2eb139939248f6edef38bc5"
    hash75      = "9833a2e03fdcf1f3f2ac44cd23d39149c5c6b8f104ba9a270a92dc9df71c3a61"
    hash76      = "f25951a4dcc4ac2e2d21180ca0b5fed3ea268d2d0a6eaa721ed8ad4ece53e2f4"
    hash77      = "0d0301e679ea5ffc5addfa8a0175fc296b76686b81e7422b2fec3d5cb5048bc2"
    hash78      = "4d686963b271c19b1076262f772d0e6617a59ee451623f7cc421c612c231eaa8"
    hash79      = "50cc0c3047af974a2b4c3fab38b337605feb5ea157aa09f968559a2caca55b40"
    hash80      = "ec046f9ca005b874885efdfe9ae48047d7fd2d8cde6545f5edf8ad3767d2e79b"
    hash81      = "0b5bdc5ecb1a3702d162e44b8a1d8f88d14ad328935bd38684b392ada4d48c04"
    hash82      = "5c1e523e257b81e1b8049233ab18fe28ca3bdae1a79160f16d50ca72da2309a4"
    hash83      = "7301d0147fe01f42a67802587ca63bb2a91e48703305d87b1081097a7a7b9da6"
    hash84      = "645e7fe4c7d615803778173d02b5396cc3a3538c8fc0242e1bf99dcb306b202c"
    hash85      = "02047f87ef577865240199aca2b70f921db6e5885feba3fa4b8dc2de4959024e"
    hash86      = "6e56c660051e67f8fe5e0036cb1541a38a48e41f0008fa2c32cd250618d2c75d"
    hash87      = "6886198c6822b64912a0f353d413ecc19d884bf66f611a63c11b86fdce302232"
    hash88      = "131dbaf4268509bd7fb3c3e4ad5bfc3ed9de1c873748673fb3fa0345af4dba89"
    hash89      = "fd3f0e81a15c8f0a974f4c48a72f2e1134459ab1be25bd76c9dc77b7e7ecc673"
    hash90      = "293ab448c0461a295e26487423773a6a7760ae1184fef98b23e9cce70160388b"
    hash91      = "6ca8ef3a3951562baf424ab7881b894faa20cdb1cd50147ca4887c1b6b3f1bf7"
    hash92      = "339ddc902c34a2eba0c343ea66e2f16f6d346b3f9c655d4daabe460bf5a71b95"
    hash93      = "9c9a6da09bcbb7af8daf8b65fc2fdbc754e379a1961723a210240c6bf5955420"
    hash94      = "51ba58701fe1a2c83798778dea2ace41edbfde3b6447a53604e7b77f6c758fe3"
    hash95      = "79b60378ac211aad46ca839926aa176225309ddb2374621510071290b31df6d0"
    hash96      = "1729297dea17f6a86acc16c0c6007818f948f42c3783e769a1d08a50bb14a431"
    hash97      = "7b2bcec3f5861d4a2eceb718aa3cc00f7a54c84af387247820b2234901c61815"
    hash98      = "7c68073af3a6780b5eadfaeee66f89dcad558734eb8f98834c17e45abd774fa5"
    hash99      = "2aee9ea9b573a5490c4ecaffde0358f0c7a10acae96185b5a65457f2ff141ad6"
    hash100     = "57902491238ff3b14b5d545653c0c6145667b246e3a26b7d0d9e0eab56c494cb"
    hash101     = "5ab91b81eee07c4007eb2027f0269b514f2f54734cf15d8a47fa0bf4c8755562"

  strings:
    $s1 = "as the licensing rules which are listed below.j" fullword ascii
    $s2 = "learning credits may also be used to pay taxes, materials and/or expenses related to your order; however, the discount speci" fullword ascii
    $s3 = " an employee of an organization that has a Microsoft Volume License agreement with Software^" fullword ascii
    $s4 = "IRE_OLSA_V120103_Def_V122304 Page 9 of 11 ^'" fullword ascii
    $s5 = "L. Entire Agreement<" fullword ascii
    $s6 = "Applications National Language Support (NLS) Supplement CD Packs: Please be advised that only a subset of the+3u" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "8c06df3257a07b290c16c6c995c9688f" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

fbae067e-59ec-4a3a-abb6-773679c0203b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion