_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_467_1_Trojan_Danger_Ge_563

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_467_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_48_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_508_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_71_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_73_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_11_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_122_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_159_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_15_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_161_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_81_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.1850FA77_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2B0EB057_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.3B0D620D_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4419CB4B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.7EFB0780_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.A5F50BFE_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.B830EBA8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.D3388982_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.DF804894_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F934381D_1.vir, Trojan.Danger_Generic.Dacic.F7D02F69.A.18899E21_1.vir, Trojan.Danger_Trojan.Generic.4385790_4_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_8_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_132_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_133_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_163_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_213_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_214_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_241_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_282_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_283_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_307_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_342_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_367_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_394_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_435_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_465_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_59_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_66_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_35_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_3_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_44_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_46_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_9_1.vir, Trojan.Danger_Trojan.GenericKD.72250432_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_142_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_182_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_29_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_45_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_2.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_3.vir, Virus.Danger_Gen.Trojan.ShellObject.o8Z@auFLy0g.vir, Virus.Danger_Trojan.GenericKDZ.103285_29.vir, Virus.Danger_Trojan.GenericKDZ.103285_49.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@a0BtHLj.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@a0BtHLj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_119.vir, Virus.Hijack_Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_Trojan.GenericKDZ.103285_163.vir, Virus.Hijack_Trojan.GenericKDZ.103285_166.vir, Virus.Hijack_Trojan.GenericKDZ.103285_224.vir, Virus.Hijack_Trojan.GenericKDZ.103285_232.vir, Virus.Hijack_Trojan.GenericKDZ.103285_291.vir, Virus.Hijack_Trojan.GenericKDZ.103285_317.vir, Virus.Hijack_Trojan.GenericKDZ.103285_34.vir, Virus.Hijack_Trojan.GenericKDZ.103285_355.vir, Virus.Hijack_Trojan.GenericKDZ.103285_367.vir, Virus.Hijack_Trojan.GenericKDZ.103285_391.vir, Virus.Hijack_Trojan.GenericKDZ.103285_47.vir, Virus.Hijack_Trojan.GenericKDZ.103285_516.vir, Virus.Hijack_Trojan.GenericKDZ.103285_561.vir, Virus.Hijack_Trojan.GenericKDZ.103285_613.vir, Virus.Hijack_Trojan.GenericKDZ.103285_694.vir, Virus.Hijack_Trojan.GenericKDZ.103285_729.vir, Virus.Hijack_Trojan.GenericKDZ.103285_736.vir, Virus.Hijack_Trojan.GenericKDZ.103285_737.vir, Virus.Hijack_Trojan.GenericKDZ.103285_748.vir,...

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_467_1_Trojan_Danger_Ge_563 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_467_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_48_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_508_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_71_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_73_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_11_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_122_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_159_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_15_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_161_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_81_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.1850FA77_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2B0EB057_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.3B0D620D_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.4419CB4B_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.7EFB0780_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.A5F50BFE_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.B830EBA8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.D3388982_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.DF804894_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F934381D_1.vir, Trojan.Danger_Generic.Dacic.F7D02F69.A.18899E21_1.vir, Trojan.Danger_Trojan.Generic.4385790_4_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_8_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_132_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_133_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_163_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_213_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_214_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_241_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_282_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_283_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_307_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_342_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_367_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_394_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_435_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_465_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_59_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_66_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_35_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_3_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_44_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_46_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_9_1.vir, Trojan.Danger_Trojan.GenericKD.72250432_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_142_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_182_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_29_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_45_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_2.vir, Virus.Danger_Gen.Trojan.ShellObject.f8W@aKzODno_3.vir, Virus.Danger_Gen.Trojan.ShellObject.o8Z@auFLy0g.vir, Virus.Danger_Trojan.GenericKDZ.103285_29.vir, Virus.Danger_Trojan.GenericKDZ.103285_49.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@a0BtHLj.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@a0BtHLj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@a0BtHLj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_119.vir, Virus.Hijack_Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_Trojan.GenericKDZ.103285_163.vir, Virus.Hijack_Trojan.GenericKDZ.103285_166.vir, Virus.Hijack_Trojan.GenericKDZ.103285_224.vir, Virus.Hijack_Trojan.GenericKDZ.103285_232.vir, Virus.Hijack_Trojan.GenericKDZ.103285_291.vir, Virus.Hijack_Trojan.GenericKDZ.103285_317.vir, Virus.Hijack_Trojan.GenericKDZ.103285_34.vir, Virus.Hijack_Trojan.GenericKDZ.103285_355.vir, Virus.Hijack_Trojan.GenericKDZ.103285_367.vir, Virus.Hijack_Trojan.GenericKDZ.103285_391.vir, Virus.Hijack_Trojan.GenericKDZ.103285_47.vir, Virus.Hijack_Trojan.GenericKDZ.103285_516.vir, Virus.Hijack_Trojan.GenericKDZ.103285_561.vir, Virus.Hijack_Trojan.GenericKDZ.103285_613.vir, Virus.Hijack_Trojan.GenericKDZ.103285_694.vir, Virus.Hijack_Trojan.GenericKDZ.103285_729.vir, Virus.Hijack_Trojan.GenericKDZ.103285_736.vir, Virus.Hijack_Trojan.GenericKDZ.103285_737.vir, Virus.Hijack_Trojan.GenericKDZ.103285_748.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "82c159eb8300168ee84a56a3df7dd431e34962ed9f98497f39df3de6470e7131"
    hash2       = "efda8d40f12f34ca68debfa2bdded8d5964de87d43bdc59b25d57a1d3d7acecd"
    hash3       = "6d262b2cdd1f35726944b88d13853a052a45d3ce9ef1f0e7baf37f5bfc263c91"
    hash4       = "c542f293301933fd94f0357d6585da4e1f52e732b131deddcd80eb64c4ca8722"
    hash5       = "a747f86432d33a4c56d4a3105e0bf49bdad601b1532f3e75dd6292d1bd52b1ba"
    hash6       = "2d7e034c58fb15375dc5befe67b265fdd377bb49554dee84e0c3f0baae798808"
    hash7       = "11b25109577cdcc70687530daf4a4e492f2434253398eed380147280b914438c"
    hash8       = "0171bd4a23e4b5869c3303e1fd9f2bdb4736c7e03b53a4cd6c994898d5e15730"
    hash9       = "f43576a693194a0d562bc2c3994cbadb4d3f8871a692aeca971ae96ee20a4dd8"
    hash10      = "07e76eed823f17cf8e8262756a4e7a4e8ef4b2ab7f07a907a97ffa4e19821d79"
    hash11      = "18fed4af73975f0b7d5656b10a8d5e46344b80fd568121f4741a8fe20d35fb2f"
    hash12      = "05d10b592ea8eb0b3c3d198ef242ed9088cf753e949b7d68c8283d6c8ff457af"
    hash13      = "dcdeec6ea5b08e2cdaa2201697d017f42819cc4c2d6798980019d3532b17a173"
    hash14      = "0575ce6770e14492f332aed6d6178b60eb5d653b8069050a3dea196b7ca3ce89"
    hash15      = "4d000c04389aaaca037715c9d3e72e85b3813a94a367381ac7236ceaa60cff54"
    hash16      = "15b5cc06a8bc9a08de17990b2ae7540c290d391d6560125f83fc338e65c0440f"
    hash17      = "25f6304d6a7ff4ae6f338806f567ee1874556a04a2b73afe5f4296fa2a9c3dd9"
    hash18      = "2c70bdd4d06fe439e0fa4e75c23a71232ff0199f02ddd71e5ed05b27563f3c14"
    hash19      = "5abb28de5b7642ca0f2c04585bd609c5e79b5d9a3c1526416276c5b8524e2640"
    hash20      = "f9f8ab208da2ebef065d2b851d4457d0e037471636430ff3b2a033bc93d90095"
    hash21      = "023dea6a1dfda0f8b5716dac0054e7a78ec85d02667a9be9ac36f90e68dc1cda"
    hash22      = "0cdf70caf04f827a9f493977a00525a8a62cb7fca6e390b78e5814d62c5dd038"
    hash23      = "7215dee3e2b148700b6c878d4be16ff6b2c698f36ba9519213a5ee59d9d737af"
    hash24      = "0f1a584dda82232fda6b06a1a22078ffc1dcca394b7e995dad267155ac30cdd0"
    hash25      = "1d217ad1aa1ae9c005a85bd7d5699a2be7d45e81b99eb17e6f53196ec01ce97d"
    hash26      = "1353122f199aa6ce53e56ce1f5f3fb3f720ec1e7517516a40b638f49ceee94ba"
    hash27      = "1091d56cb3372fa6dd7fa11c12281f7888c5ce8437e50a8f1d783504e06e0999"
    hash28      = "13a15d33ef0c559a448f347d4c0abece5ac23ce0db59db84ae2144eba9e940dd"
    hash29      = "65c00533b1694b297b8d65b1b41ac037621436f0844bf983b836bb71be0be123"
    hash30      = "3e37bde50e6bcec426ec4f6809bb5dcd4954c6971cd68d07d6fad685c2203c23"
    hash31      = "4e34b7db9c9239e0ce08173e24d875b521cf22eeede4b4d0a5581ae6a3a907dd"
    hash32      = "486f782913f40c2e0ca3c6c65d531aaccff7019e86f11f01e469a3fd779c7f5e"
    hash33      = "f29e3ae3e496a8a16f1046c3e5e942b166d64feb88be397890cae446a58b65a6"
    hash34      = "a671b6c51d1ee4e1c962d90acfb7f14daf17014b1eaf8e006ba2c61ee4f4fec7"
    hash35      = "cf6412e67835e2f58024c29f5bff6c30d391ad62376135ab06cd2b958a7c772b"
    hash36      = "3cb17ad96a92610f3fcd95d5fd2c04eb998cbd666e14388276fe3c746c9c0e97"
    hash37      = "c9e29e79693e78bf4e5f549c182bca9aa45f530c72a48bc8dfd47189a9ccc40d"
    hash38      = "5223dbdaa94cb27e23cb7f7f8f72dc28baf9411330ae6a6ed46e44076ea1296e"
    hash39      = "354ab2b20ba108139a53cdae92be6713f08af7fd9713f8e43072a3fa39c58498"
    hash40      = "713b5f2915dd1714b37d05f815c425bbf9287cb085f8d020ebfbbdb5f044d93e"
    hash41      = "9ad86b97cc2868a31dfcd219e8375c51715501b28d79f282231f146a297fe2cf"
    hash42      = "6a35b031da0e18ad336c08bb0b4e685fcc0c3fc702ec66a1d6944c95bf1574dd"
    hash43      = "296b709e8345e8211ad45d63570347ffae4f456def835bc0cb924c999fe26a58"
    hash44      = "6b55f30a193dbf5936d88de9ad2292d1cd8ac0feef09092d2fc95a5c65f06c5b"
    hash45      = "5fc42aa63d1b08c82cb754942dd36d254eede51b74acd5600ef6d36c1b65f4bc"
    hash46      = "9a2f8e69e2615c7d652a8e63d4308d7e1c44adca44186f776bdd40b1ae3d8b07"
    hash47      = "14638a1e55b277904280cff0c7a38b16e976e19e55242e056e7206a5d353401d"
    hash48      = "e9ab6361bf2911cbbf39ca936da9deccdbb559571330ba87f22632605cfc9f84"
    hash49      = "ec0266c11e0667c0d8aed690deb4aeb8ec202e6734b41cf0fae87f496a9f60a5"
    hash50      = "c11fb7416e42506360512eff333d1a469c24e9d0c33d1ec34d18fbe85647c0f4"
    hash51      = "770bdd60b991a06085da91be4dceb537aad5d4d9694832c7d54d33b3deaa8dc3"
    hash52      = "60c41a93c6583a397451df8e3aff21e0391033d4ea1b0e413e7b0ae3daae9c77"
    hash53      = "01dd26ba0d2e120a81343b77e06b27480e01e8d0941328d6fd41f4b326238530"
    hash54      = "311c4d19ee4531e9e04ec09b998cadc68db502868f83455be6c2b5f5d7d07631"
    hash55      = "820a8c919b19466f9128b956a749a1c305d3b852a8dc77d86533eb2aa3c8713a"
    hash56      = "0bcbf5de51202881b9011681bb3c056e8792595ab155f706546c733ec1b70ccf"
    hash57      = "07b91e4cce76771a527e1d4e24f91fde25a9cca1ca3087dbbba0783bd45874fc"
    hash58      = "25c87a1a67be821c730aaa5bbc271d20e54917ee0f327a773881856392db86cb"
    hash59      = "ff855706b3fd05b9f780c06fab6788495214743591daaf68ab93148cd989f83f"
    hash60      = "abc12f7b3ba761e76a821a276a60b953bfa3dbc847d6b96616669b05f2e3a9b6"
    hash61      = "f554f6ef1639cbff8cb3345c1c644a30cba5c23376ecf8514ca321a0c9bfb5b5"
    hash62      = "5a1d3da099283e85d6bd065c14f15530d1d486bd52a180cd97b27a65e5c06e79"
    hash63      = "ec47b755154cd535c4c9eb4ade6a5b40863546fba719ea8c2835ee926244d0c6"
    hash64      = "c6629672b000a1c5e25955ca09d51a3e5489dff488daf9732cba1d9ef3fc3a07"
    hash65      = "3a5e68307c5e1ef8c0b830815621cf30153f32f2354f45361c1dd3a35a8ba93c"
    hash66      = "efde7166b772730b410c4f489d6734f0d3b24d7577b388a1784e11178ac93297"
    hash67      = "1f8467e4e36a79584da7b72c6cd8f1b2b817a2ceb263d85495aadfbc9eed8ee4"
    hash68      = "4db229d8f5148196e8ceb63c27870c73369554ab318f6d6fe07b6648ed5139bd"
    hash69      = "ae672ec57a8b829821f120977bf17460f49ed2d14ed23b3eaa09b95fa278085d"
    hash70      = "721d01051405e747816724b0e8525eb81c5641448da64ba1fce3e7c8d1df7b15"
    hash71      = "b753989810db8d68c13373028a3e062543ae21d4dd6fd4fe0abf96c6a9d9ab08"
    hash72      = "e2e6dbae4bb2ce7aba8efa8723b443445989053835fa666dc8bb8e28511a1de5"
    hash73      = "ad663580c5f93b3b262f1da8b0ffc61568f0c5e4bb58aaecccdbe4cd16666a8a"
    hash74      = "89be96c1cf3fee7e2fc73628ff645d8c2d948577f67f0b7660bcf00001285dbb"
    hash75      = "1e1f944dea5ee4c394217108898efd8385fd3a87bbcfe26864181a38bb652dab"
    hash76      = "c36a93dd214307c549d7a5d2c7d8f34030f81cb59ff1badc47cedcf39493c120"
    hash77      = "a970ff7c77ca175edb62b795113925226b44b80c639d66347c2abe6eb307e085"
    hash78      = "cae2de91f0a4b1b418b3f4477a470e2a397d326ed9d35b71a87b420f0f03cd80"
    hash79      = "ece9a65177f697348cc07dc3f4c6c4bd4ba438c76784656fcbec11ab76951c42"
    hash80      = "5532c41ab9b950e5d7d23b8a042e0fe432da7f56ff9b5496c2ad5eee739fe71d"
    hash81      = "6ab52656629d62045b4839bdf9d676f93b9e787d8e7c93d8bb6eeaf4e93729f5"
    hash82      = "83de83292271b9bc9ce8c3e03245d0ce9c203f324f4f2fc0261eaee4ef24ff13"
    hash83      = "c6e98455311bd37c1a466e45c0719aebfb9ca04baa1f5b1b3508122544874ca7"
    hash84      = "f823fa98c93effdc559477eaf77bcbe965c8fe426d612bc715d9472a6a89ff55"
    hash85      = "179447f8d0792ae57855a7648738e4567845bc0d1bf840926e769fdbcac731cb"
    hash86      = "9d28c127c26f9f98e2bc56e5092c7bfe37094c02e868c2b11b36e4b1a7e422e8"
    hash87      = "6885a0dd269ae1e98e30ef1ebed25fed93bb2a343f5dc00fb5cb916e5f4bfb4f"
    hash88      = "2a5c91370615602743be54e0e969f7c60563bdb9a8325a3035dc2eb86d34b811"
    hash89      = "eb089cea5ef1181ef85596a80fb04458fb795e542871ab084ec48d1e19719227"
    hash90      = "70dc1d4bc5d115b7767ec34dd1ced971e03e71e84166b0205bced33a77647917"
    hash91      = "2cf27e8226c6dd8d3ac26768936f93ff4d7a1d4220ad88721056117c5e85e39d"
    hash92      = "5e3dcbb18d6225c6cb1501500033bf57350a3e55f173e82446d102fc0f5f2d5f"
    hash93      = "358fc64ce5d13b09a8440fe19e87d55d5ebafa44f329fc7677594be078acfe09"
    hash94      = "c13b7c3215898832785624d4e282ad395ecf3b844f7c1b5f9f2ba56064b8024c"
    hash95      = "426a60852df138c315126916d79b7f6175cf93b1deef48449cf0fb353f93717e"
    hash96      = "4ca1edf437aa28f3758cf45502f0cf2f93ff8f5c34f3bc38d92b4901c50206e8"
    hash97      = "caffd4acfc1f50ff5579ead53ce0b17919776017c9865a5b1abeba83a422712e"
    hash98      = "e8030d965985169859db6765041967d6ce5689d0a92062c5ba8e648560513040"
    hash99      = "bab1a758aeb1e5ae3b799fba394857f3f8eb0416bb2eb06c3daa843be70848af"
    hash100     = "76e9a5934996fc5be2a32d8a83e0b23c237cddc9fd5512569eb09c62ea1b5797"
    hash101     = "4400f4e2e47672fb4e2b5f0b97cb92d6517e03c0811bfc7e09468438698d0a7a"
    hash102     = "8e8db44c346b6419d3c7859adadcefe70b7e9d09cba4a7abcdb3e4bb9e72a023"
    hash103     = "ffa69a1d9d549c557d40a067ad202434dda227806728ea29f15751c327b7de3d"
    hash104     = "2a16ba929c5fcf407b352b08fda6540b25c1880194ef3495512db48765e108ed"
    hash105     = "e10ad5d5cc5617d790af1b33ab5eb1cc43bd0f12bdff3faf7e3cc48b9c2c2217"
    hash106     = "b7b14a5d6c4ff0b929a0fb62b9dc5ba2df564a5769b6ba82fe8ec48554a56ca7"
    hash107     = "640e4a086ac0b36842b7e37f021373586d76f5cbee687b393d6d1ed2311c70b5"
    hash108     = "911b40975baa0cd09e78f2cee0cb8e812f83c7ec5590ce053962bff8bd728197"
    hash109     = "6b6b9588c1fe5b0e919c43cb3126e6f6d4bab533566ad1c6d164c1b97f025ff4"
    hash110     = "7ab9c3a1d44d01be5960c6f80441d0cdc97cf27c7ae493c548618e180e85d2b9"
    hash111     = "ffbb867ae3fe0ed59b1ab771f98737d5257a5ce408cd7e7fc2351b62bd5e103f"
    hash112     = "0347ed3574700cef5b9456d51e8640564b1a50e144058d09b27bbcbb4b3d7018"
    hash113     = "9997ea5010e4910cd96cdc4594770808658c4157f36f0cdb79e295fffba9641f"
    hash114     = "2f4ca3400333ec4036826e347dd2e6d7e5227ce24a8092fdd2749f32e8da7747"
    hash115     = "af0d5c728b7f90c45a17f30679df1313b99dbf194582e6a369920839dd0301fc"
    hash116     = "50074791848b390df73ed928bcebd2cc621fea76a18c70d8b83eafa12b57401a"
    hash117     = "995528701b195bb4c2af26f31873325f2390fea3b22695044bd1f9b43610fe8d"
    hash118     = "a0a45ed28fb29f7e401846516db7a22e093851bab1b28591bab2f20f22b089ae"
    hash119     = "2bc44f65105d1373ca5054d3223003d30c5c153fe41e522cf864e06e77dff1fe"
    hash120     = "2aac22430f932b755a4e6aaef6d21b862834c5e7aa45120585e3524536eddcb5"
    hash121     = "f4afc06c76229b423571ddb1e344ddd4e8f6f2b0f6e5e6d82dd06bb7ea56b574"
    hash122     = "7ef2625bd0b4eec1b1921af9f1973d1b624984f765a58c0e95ec46eaa0aaa618"
    hash123     = "9f11ccb90e269b44139bfccf33099a95ed2a99b633ec034fa69c70227a749d23"
    hash124     = "9a9aabf58aeee636e493aa312f38367099f6dbbb208a49a079239af7301472e0"
    hash125     = "f68ee363141199e39ea21f5d35c3b07f0fbe2fcec1d1ad51ce01eb61ca756a7e"
    hash126     = "d6b9f145696bddf5dd0a0b3a7246629c04f50f2548245ae04073f85d2ff4ffef"
    hash127     = "3f2596da5721aa1306d97c674954e6c6f81b7f4fcd64d0563007efa73894bea7"
    hash128     = "3f5bbbcb71fd6b7451642d4378db460be517a6f41d89a3d7a2db67ae67f741da"
    hash129     = "77206a1f966cdc1626b4d519c5ac67ffe2273cad8f2bf631eb7f12ed690abd3c"
    hash130     = "efee2bd4bb6280aeea6e87adcc7d75d8a6535f79a1733e9dacd4e1eae23e9cc3"
    hash131     = "cb9d841166bb754e3b4e999366c82f75da5a37ae16a0d745b77fe5e6cc715422"
    hash132     = "9883565d8b0d10cf2dab8c321179a80627579c8b088ab5b832ada03421b7a087"
    hash133     = "b881eb9d1dd8464454b8e44331d89060ded3aff89043c4a9c0cecbc02df9e78a"
    hash134     = "87822f592c9de6b7a22c7fd3e44d375805eb8be31099f622f8f2627e988d315b"
    hash135     = "ba420c94f67c0dbfbd94c885a546c2c75edfb7082cb1217c6d25db98e4920d1e"
    hash136     = "8085677c021e3310455523e26c9a5373e08103e5885031b1f476114812e1ee18"
    hash137     = "bf481e7442d0f5574415471eba2de05d4792fea099febdc9221fa6dd3b580cfc"
    hash138     = "150941ff970e38cfb540489dfb6c9eb7a577258ddd8b994e3605e3400df673ee"

  strings:
    $s1 = "Trade Compliance web site which can be accessed at http://oracle.com/contracts. You agree that no data, information,!fn" fullword ascii
    $s2 = "You and Microsoft will attempt to resolve any dispute through informal negotiation within 60 d" fullword ascii
    $s3 = "software are limited to the subscription period. You may have the option to extend your subscription orN" fullword ascii
    $s4 = ">If you live in Japan or acquired the software while you lived in Japan, we grant you the following rights" fullword ascii
    $s5 = "Kauthorized by you to use the application programs which are installed on a single server or multiple servers, regardless of" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "27005e87bd5f42155b320f82a08aa94e" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

43fef0f3-e4d9-4fe9-94cf-d164b0677661

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion