_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_488_1_Trojan_Danger_Ge_564

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_488_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_516_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_61_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_89_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_92_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_150_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_162_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_7_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_97_1.vir, Trojan.Danger_Gen.Variant.Razy.448479_1_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.35CA7E73_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.445D3B1D_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.869124DC_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.ACC2F01C_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.C2CFE366_1.vir, Trojan.Danger_Trojan.Generic.36486627_1_1.vir, Trojan.Danger_Trojan.Generic.36486627_2_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_24_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_9_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_149_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_229_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_297_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_356_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_405_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_446_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_473_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_9_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_132_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_167_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_170_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_187_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_205_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_217_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_22_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_27_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_38_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_204.vir, Virus.Hijack_Trojan.GenericKDZ.103285_267.vir, Virus.Hijack_Trojan.GenericKDZ.103285_318.vir, Virus.Hijack_Trojan.GenericKDZ.103285_337.vir, Virus.Hijack_Trojan.GenericKDZ.103285_372.vir, Virus.Hijack_Trojan.GenericKDZ.103285_388.vir, Virus.Hijack_Trojan.GenericKDZ.103285_4.vir, Virus.Hijack_Trojan.GenericKDZ.103285_462.vir, Virus.Hijack_Trojan.GenericKDZ.103285_541.vir, Virus.Hijack_Trojan.GenericKDZ.103285_592.vir, Virus.Hijack_Trojan.GenericKDZ.103285_600.vir, Virus.Hijack_Trojan.GenericKDZ.103285_611.vir, Virus.Hijack_Trojan.GenericKDZ.103285_615.vir, Virus.Hijack_Trojan.GenericKDZ.103285_633.vir, Virus.Hijack_Trojan.GenericKDZ.103285_697.vir, Virus.Hijack_Trojan.GenericKDZ.103285_750.vir, Virus.Hijack_Trojan.GenericKDZ.103285_822.vir, Virus.Hijack_Trojan.GenericKDZ.103285_827.vir, Virus.Hijack_Trojan.GenericKDZ.103285_842.vir, Virus.Hijack_Trojan.GenericKDZ.103285_883.vir, Virus.Hijack_Trojan.GenericKDZ.103285_94.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_488_1_Trojan_Danger_Ge_564 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_488_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_516_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_61_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_89_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_92_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_150_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_162_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_7_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_97_1.vir, Trojan.Danger_Gen.Variant.Razy.448479_1_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.35CA7E73_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.445D3B1D_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.869124DC_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.ACC2F01C_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.C2CFE366_1.vir, Trojan.Danger_Trojan.Generic.36486627_1_1.vir, Trojan.Danger_Trojan.Generic.36486627_2_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_24_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_9_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_149_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_229_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_297_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_356_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_405_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_446_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_473_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_9_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_132_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_167_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_170_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_187_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_205_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_217_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_22_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_27_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_38_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.C8Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aG4fkNb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_204.vir, Virus.Hijack_Trojan.GenericKDZ.103285_267.vir, Virus.Hijack_Trojan.GenericKDZ.103285_318.vir, Virus.Hijack_Trojan.GenericKDZ.103285_337.vir, Virus.Hijack_Trojan.GenericKDZ.103285_372.vir, Virus.Hijack_Trojan.GenericKDZ.103285_388.vir, Virus.Hijack_Trojan.GenericKDZ.103285_4.vir, Virus.Hijack_Trojan.GenericKDZ.103285_462.vir, Virus.Hijack_Trojan.GenericKDZ.103285_541.vir, Virus.Hijack_Trojan.GenericKDZ.103285_592.vir, Virus.Hijack_Trojan.GenericKDZ.103285_600.vir, Virus.Hijack_Trojan.GenericKDZ.103285_611.vir, Virus.Hijack_Trojan.GenericKDZ.103285_615.vir, Virus.Hijack_Trojan.GenericKDZ.103285_633.vir, Virus.Hijack_Trojan.GenericKDZ.103285_697.vir, Virus.Hijack_Trojan.GenericKDZ.103285_750.vir, Virus.Hijack_Trojan.GenericKDZ.103285_822.vir, Virus.Hijack_Trojan.GenericKDZ.103285_827.vir, Virus.Hijack_Trojan.GenericKDZ.103285_842.vir, Virus.Hijack_Trojan.GenericKDZ.103285_883.vir, Virus.Hijack_Trojan.GenericKDZ.103285_94.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a9d7ee6f8f1cbeaa93ec08abaffdba01caec81f57bf62beffebd735901590204"
    hash2       = "b1e04ab9dcac8dbd8c6d4e1b91e777572b93027570a4e2d69b49ebe1b61657fd"
    hash3       = "89ba67d4af408540943777e3d81f20f1323c5e9b8ba2092d3f8819e47f38bf93"
    hash4       = "5314e991e6faecd7476aa5ea0fc5fe78bb354717f09337bbcd000b56095f92e5"
    hash5       = "85bfee2a28df4316384e2d236763a2a0949abe50c013dc2bd1e772415faabba4"
    hash6       = "d7cffa0b7d46d0c6231576a71b849237e3d0f32d6ee18e67f4625d35802cea70"
    hash7       = "b63a8a72418465670b5e62ead217f1af80818408d5ce752749ee7c92145afff8"
    hash8       = "24534efcefc798edba37bf681d6fff047754c21982889587d46624923d73bd1b"
    hash9       = "555d60f93f12b2ce74f4db16a92bafcdda58c66eb7999ee0da4b08892ce212ff"
    hash10      = "b2c8757ca85d8459361a5789569ac2cf7d0c1a01b6184ee40f7aed6e63bb8891"
    hash11      = "7dbd54b1e110d7698f1eb62bd06ef83ffa5a7ba9e74da9a51addca893b604d0c"
    hash12      = "98549be6c0fe35347ac6a17e9537317f2c1274afc7d1ccf3910013b9a061a8da"
    hash13      = "5c1ff9babeb7cd4da5ed9c1b3b964b6ec8d1c5af97a0df216a9fe6d7ba2d23f3"
    hash14      = "ba049e0ba06be7d4f98d32b26178ae12fc1d805b1b62d8ccc702b53aeee38dcd"
    hash15      = "5bedd4b2d7eb2fb1b304cb03e2b01643173dbff01f0c676998ad2c6ff99fed46"
    hash16      = "ca41d52036eecea6503c1c59fead2a50aadcca0eded81d2455cf3529a7f414d4"
    hash17      = "77633d3258aafa3e436c5800767ae6689d546cf704c66a918814ec207e2a606f"
    hash18      = "8ba52b2cfe29bbd425d6b786e19d008e2fceb29ab1e1288ee6c6fcd30400961e"
    hash19      = "79b63655d2363fe274df733414e70c9e512d208d2c5c5c76eb0fd027843611c6"
    hash20      = "db5add74147234b08451d16ab10b1b797ba2cb95a8867cb36223de5de89f5692"
    hash21      = "494aba8dbe3b0bf7662a7ca1a83319838cf9f8e0e5be81e11db4f37fbbb29a59"
    hash22      = "28569ec50f2f5467d1635cb0d7541881b9ebe98e2d0e894a2f4d47455f56edd3"
    hash23      = "f5735c6342156a5d0dbcd05f2d05f3bc79710cde3cc7cb851a0f768f322ff76e"
    hash24      = "b8c179224ac24d8084d7ab6c5c63aad93f4c335500ed892541592b7b65edea18"
    hash25      = "3550a8bc7b952520dbcd1100181038867e0bb02a6936783f171c2e6680670815"
    hash26      = "998277b2f74162d9d061d12f30d8f37109faf24e583ace5d9244af0d3976dea0"
    hash27      = "993d2cd0be366ff0ebb83df5ef5449db402204142d490672b917fac748b637c6"
    hash28      = "59e9f5d124517b1a4be5fe797450f37942160b5cf928a704b41f44e33772e4f8"
    hash29      = "42cb3b4eea993549b3d5440e896c5ecf65e47726fc7dedd7df207e54cd815ec8"
    hash30      = "0bb79d7804fd859e5e729af4297f96529dddb6ce8df47f86c238488bb80ecfe7"
    hash31      = "2f3cec77a28f2b26d50328c4271e0b08341f8ea6ee331f99cd6ed80472de47dd"
    hash32      = "413aeccf6470d148e9ff5c7a21a632173f7670b7238ce333ea69bdad8177d31d"
    hash33      = "cb0751038e343d1deb4527fe8c455ca75466ee4902e2c32ecc50ee88097e690b"
    hash34      = "0995fabd2318c6f0193ee2f2eeaab8e396c99b7afc6b6dd4c693c97d0ebc2b0a"
    hash35      = "a4ff5fe236a1b08f595688b1f46e663772a8f154aaa04dccf59b93d8d81263ae"
    hash36      = "fb2dc3fced00ff557ad7cf7b3a0fbe6a672e6ab82617469f8f988d05c51bf505"
    hash37      = "53a52e64c5c483d77332740abc444512d409c4ebfae3d51755bf265ba3ec6b43"
    hash38      = "99cb40e9bd04586f17da5b5b896129e279418cdae0e0bfed97d5e851ba6a3fe6"
    hash39      = "000c72261bc1d6f9ce2be35ad4eecf0710b58546fd75f5b277475b279a856b35"
    hash40      = "6a12ff2c01b629c63e912b4e63ea0b51e1c0e4dcb02eef0e1da643044a3b7fa7"
    hash41      = "52a328a9a2028b5ec531d45e8ef51c1a1a93247fc6a2bd71d40b80b262aeda36"
    hash42      = "ccbed825efbb018798358900e2ef83574c8b7d8c0db1e2fe56eac3d63cd15ea5"
    hash43      = "bc437c3446c4080a8fc0584cc9166f2a9ad503d78edd6eb6138299a7b55711d8"
    hash44      = "2e54076e6b5bb8a8d522f58bd2967361fc6e2ffb6a3aa3f5c0135802b0f75e2a"
    hash45      = "a0d7b55f8a7353ff495fe29c368c10ac24dab39cf40a6a5998bc070b10872daa"
    hash46      = "92c12d86c395fa7404ee7c3190398b35b13fcb6803f777575d60d1ac57ad5270"
    hash47      = "8954eae0de05f84d3fe76da5f32abb01e1d0456cbeb11b48df2a83107e914664"
    hash48      = "f6da24620c558a57525947a3972585fa4d962366d7c67686348d47b55687c6e6"
    hash49      = "9f78cd868322173e58f154a52e38749173c2051584c0a8a0d3f8d1f72aa513d5"
    hash50      = "eda978f87c9c5bd937dbfbaabd5783dc140960ffa3eac84ddfd0e15271ee21f8"
    hash51      = "958c01323470ee531543aed84ecc8e609ec4b9342ecd0b3fa56741877b9b2de6"
    hash52      = "5c1184426754913c37cfce7085702ea28699264855c84fae2654838cf2869412"
    hash53      = "af52dfb9de5d4c7d2ee46b4c17de60466509034d0c982bae75407c3c808f927a"
    hash54      = "dc9923fdeefa027233a26c0fbe1f9db73b41dfe3a80d879a1571cadcb8e82fb5"
    hash55      = "0b2d71b88564127b450716a7c3fce19ab96412a0fb4fdcb9f273292294518334"
    hash56      = "6677f4e4428f8bd6db7fd24d2c8e58c8a9bbdf0443855f7888f4156d24c5f7bf"
    hash57      = "d8f1dbadef5a9f3b6d2b12456b18f5d69d62e21bc998650dc62e43b11c9aaa9a"
    hash58      = "a866541ad04bfdbf4367435f2dbed3ddc506cdc08bf8ed6931d8ca112c70c08e"
    hash59      = "fb8e2e1214e4658cf3ba628e8fd6067963f848914988dbb640158be27175b406"
    hash60      = "c2af749a6bb1a69945b671dbc091824dbe54dd052412f239f32a984d6e5ef712"
    hash61      = "22221a4ae37c1ddbcbbded0c50bd7980af3f4b1538e604e1edb3cfc2ebb55b2f"
    hash62      = "f5a1454c5ac8476866538ced07f3a3392ab8ff792acb07100baabb53cd4ac58d"
    hash63      = "acea15f15400af40dc23a8a9ca6550a1a47024ec7573c2d623ab8cf0ee2379c3"
    hash64      = "3f0e9c8c42bbbd884786aca0b0ddb96f3c8431727e1ed781aeaef9e018ac35ef"
    hash65      = "9f1fb99c3e740351d65dd6ccb21b571e5559f63f64cd65a7d795dbc218193d3f"
    hash66      = "d439173e080b2050306329114ab4aa259b05373dc54118f86be4f26eccd44479"
    hash67      = "2eabe20b7b097ada747298e6481f90df85bc9cdb3e52a8b195f1afda873ba578"
    hash68      = "f0efd4739cc64698d49ab74d49c93c2988e859357d48b59869c646e4d9e5bd2c"
    hash69      = "0c7422f4beca463dfec1e976aa2eb5f54afcc6f28157007b8d63ba04060ca7cf"
    hash70      = "397349e06e1229488a8d2b5ca2f537160e9dc1514914084637ff8fa4971e7702"
    hash71      = "65de6f5d2513485fa94e41dad36d124b076348cb2296071c57ad3ba5ee9e96c0"
    hash72      = "855aeb79d306f244fec96b1ca750840dfe39a050d7bc1abe33e103708ce010ce"
    hash73      = "12097d6e81d219f40be854e5567fb461873f90bac14b251588865716aa2a970d"
    hash74      = "c20c666fb72c7ab42f4573ca918d881dbd8b375074d14c2e8775fa0a25974c58"
    hash75      = "b1007eab97246b15b2376d5c8e406a814729753f5809df5e43b73cf2c3f74e93"
    hash76      = "95144a40eb7f90ec1ce9dfe0c2843fff6b85bc7c4c1512f412a5b93e194b417e"
    hash77      = "b7dc9bc076afbc124f45164a8760b616f2a6b4a3c27fb160d62322746fd907cd"
    hash78      = "c57b73f52ed0f89e9c4ed5804141c9ed2eec664b739c7916a852f799e3c7232c"
    hash79      = "4e05fefccaf1ecdbcebb4274fee9e5be1065abe566aaa035653b29043a1bf453"
    hash80      = "91e56deaefdd424113ba29d7f79252a602261bb1a38a786453bab922c20645bf"
    hash81      = "5c87e14f429e0b7d9e8e90843bee74e25ec09529d4facec2fc6f26a1aebcd300"
    hash82      = "e02ec08a5e457111850c8dbefb99d51ec8c3279ddbfc761b99eb99443be68d0a"
    hash83      = "0b5516e495b586cf41789fef44280e76b17ee8373cafd09e793d2afcd9d8f512"
    hash84      = "24c7c03db3880e730c74dae2cc280716b08cb51c0567ac871349aab645e86884"
    hash85      = "2318a122ca4b538b8e508ab517d9b4e871ba7d2728d5fa44d73826502788a692"
    hash86      = "48bd6673a30efac39bbe2a528c93cd7bd0e06bae4f6514ee3633a3586afa6178"
    hash87      = "130de210c9c0fee142b4d8d3364b17efb83ed89064a7b061efca69f2acf1ecc3"
    hash88      = "33251932a366bd136d145de90d691c2af9dabeb696706bbfbc6793aa36d573b2"
    hash89      = "8d2ee4c27d8906037d96d13e3af8f75f316ffc9708c7528b8b86466cd1b84e0b"
    hash90      = "472b1a398243a62409621789f12b597f5c70939fde18c8840be3ed63de802017"
    hash91      = "25615d5c773ecc8fc42052d95d93930004c44b00dffb96a29c18d544f9ba3f82"
    hash92      = "50f00fe32adc80e8bba2d4302308bb68dadbfca789fafa7fb89c80a323563ad7"
    hash93      = "cf490dd281d63dcfc6072bac9fec6d21a2b7d30f2f4f8eea32b065d8139b326b"
    hash94      = "3476f6996308fc3213f40cdc8dfbf59594a77994bb6d338e731f97459ff5108d"
    hash95      = "18a8461420598db939c2e9a18b309f2479ce72b7f09c572809db20c59654fe6d"
    hash96      = "d908e07239c622be7fa4bb3024202e0306e7450c3b278696e0a263a3612dd839"
    hash97      = "c1256636a4b7863ba71eae0de45e5d70f0a24a3f3ccda6f56f9fde1764c2cd57"
    hash98      = "dcdd287c6f685426ffd3eaa8caf658dab421bd9323afe890d86bf448ea929e8c"
    hash99      = "1147d8d5572986ce5113a3dd8698a4acafda1b82134d4a2a1058e754c7d0e39e"
    hash100     = "a1b6787209e720d944e9a9341a2bcaabc7f0f5700798202e8effcc77e0b2c922"
    hash101     = "591a212f3a907902d19df964e748acf715ac13772868d4070abd579e4d35a4a1"
    hash102     = "75e0689b0cadd1c99c419755db1c6360cbed5c57a528c2e6882e8c02a1bda977"
    hash103     = "6fd4ac7c7fe990430bbf925ed321f6cecf52b7f78e465712e4a2d211008dc042"

  strings:
    $s1 = "IRE_OLSA_V120103_Def_V122304 Page 4 of 11 v" fullword ascii
    $s2 = "from the effective date of your order. At the end of the term, you may renew your order for an additional 6 month term at thep" fullword ascii
    $s3 = "Employee User: is defined as an individual authorized by you to use the application programs which are installed on a singler" fullword ascii
    $s4 = "by you to use the application programs which are installed on a single server or multiple servers, regardless of whether or not/" ascii
    $s5 = "by you to use the application programs which are installed on a single server or multiple servers, regardless of whether or not/" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "baaaba00628cb52992b1e0e3b36f8cb8" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

91a4a46e-c87d-49bc-88a6-bfd801436134

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion